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In 2018, terrorism continued to constitute a major 
threat to security in EU Member States. Horrific 
attacks perpetrated byjihadists like those in 
Trebes, Paris, Liege and Strasbourg killed a total of 
thirteen people and injured many more. In addition, 
one terrorist attack by a right-wing extremist in 
Italy and numerous arrests of suspected right-wing 
terrorists for attack-planning across the European 
Union (EU) indicate that extremists of diverging 
orientation increasingly consider violence as a 
justified means of confrontation. Terrorists not 
only aim to kill and maim but also to divide our 
societies and spread hatred. We need to remain 
vigilant if we are to protect our citizens and values 
in the face of attempts to use violence for political 
aims. 

I am particularly saddened that three police 
officers lost their lives in terrorist acts in the EU in 
2018 while trying to keep their communities safe. 
Our thoughts are with their families and loved 
ones. We pay special tribute to the late Colonel 
Arnaud Beltrame, who exchanged himself for a 
hostage taken by an attacker in Trebes knowing 
that he was putting his life in danger. 

Compared to the year before, the number of 
attacks and the number of victims in the EU 
dropped significantly with regard to terrorism 
of all ideological tendencies. Whereas in 2017 
jihadists perpetrated ten terrorist attacks in the 
EU, we suffered seven jihadist terrorist attacks 
last year. At the same time, however, the number 
of disrupted jihadist terrorist plots increased 
substantially. The latter included attempts to 
produce and deploy chemical and biological 
substances, a fact which illustrates the level of 
intent and commitment of individuals, cells and 
networks to use terrorist tactics to harm the 
societies they live in. 


The level of the threat from terrorism, 
thus, has not diminished, despite 
the military defeat of IS earlier this 
year. If anything, the situation has 
become more complex. Within the 
jihadist milieu, multiple actors of 
diverging motivation and allegiance 
are plotting alone or conspiring with 
others; and right-wing extremists, in 
a bid to justify violence, prey on the 
perception of a threat from Islam, 
which some people readily fuel by 
interpreting terrorist propaganda and 
criminal behaviour as representative 
of a world religion. 

In the light of the above, I am 
confident that the efforts of law 
enforcement, security services, 
public authorities, private companies 
and civil society organisations to 
counterterrorism have substantially 
contributed to the decrease in 
violence in Europe. Faced with the 
surge in terrorist violence that Europe 
has witnessed since 2014, public 
authorities and private organisations 
that used to work largely separately 
have established new and creative 
ways of cooperation. There is a 
general realisation that everyone 
needs to play a role and must assume 
her part of the shared responsibility 
to conserve the precious good of 
living in societies with a high level of 
security. Equality and freedom can 
only thrive where citizens can trust 
that they can exercise their rights 
and participate in public life without 
intimidation or fear of violence. 

Unfortunately, in a growing number 
of locations outside Europe, violence 
has become prevalent. In countries 
like Syria, Libya, Mali, Afghanistan, 
among others, terrorist groups have 
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gained influence to an extent that they rival 
the state, whose authority in many cases has 
already been undermined by particularistic 
policies, weak structures and corruption. Citizens 
of these countries are exposed to existential 
threats to their lives and property based on 
their belonging to particular communities or 
adhering to particular practices or beliefs. The 
perpetuation of these crises has proven to have 
an impact on Europe, be it through the creation 
of new grievances or prejudice among different 
communities in Europe, discrediting international 
efforts at crisis resolution through diplomacy or 
providing space for destructive ideologies and 
terrorist networks to prosper. 

As the line between online and offline 
communities becomes increasingly blurred, 
terrorist propaganda preying on human 
suffering abroad reaches audiences in Europe to 
unprecedented extents, inciting some to act and 
driving others to embrace extremist views on the 
opposite end. 

In Europe, the feeling of insecurity that terrorists 
try to create must be of the greatest concern to 
us because it has the potential to undermine the 
cohesion of our societies. Increasing polarisation 
and the rise of extremist views is a concern 
for EU Member States. The public debate 
about sensitive phenomena like terrorism, 



therefore, must be based on facts 
before reaching conclusions. I am 
proud to say that the EU Terrorism 
Situation and Trend Report (TE- 
SAT) has provided verified facts 
on terrorism in Europe since 2006. 
The report has been accepted as 
a benchmark in discussions about 
EU counterterrorism policies and 
academic studies. It is my privilege to 
hereby hand over the 2019 edition of 
the TE-SAT to the public. 

In doing so, I would like to thank 
the EU Member States and third 
parties for their contributions to the 
TE-SAT 2018. In addition, the work 
of the members of the Advisory 
Board, consisting of the 'troika' 
(Presidencies of the Council of the 
EU, namely Austria, Romania, and 
Finland); France; Spain; Eurojust; the 
EU Intelligence and Situation Centre 
(INTCEN) and the Office of the EU 
Counter-Terrorism Coordinator has 
been indispensable for the 2019 
edition of the TE-SAT. We are grateful 
for their continued engagement in 
ensuring the guality of the document. 

Finally, the somewhat technical 
discussions on terrorism and 
counterterrorism should not make 
us forget that terrorism affects real 
people. I, therefore, want to close 
this foreword with a thought for the 
victims of terrorist violence. • 



Catherine De Bolle 

Executive Director of Europol 
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Trends 



Thirteen people were killed in terrorist attacks in 
the EU in 2018 - a decrease compared to 2017. All 
the attacks were jihadist in nature and committed 
by individuals acting alone. 


In addition to the seven completed attacks, EU 
Member States reported 16 foiled jihadist terrorist 
plots, illustrating the effectiveness of counter terrorism 
efforts. The significant number of thwarted attacks 
and the so-called Islamic State's (IS) continued intent 
to perpetrate attacks outside conflict zones indicate 
that the threat level across the EU remains high. 




Three terrorist plots involving CBRN materials 
were disrupted in the EU in 2018. A general 
increase of CBRN terrorist propaganda, tutorials 
and threats was observed. 


Ethno-nationalist and separatist terrorist attacks 
in the EU continued to greatly outnumber other 
types of terrorist attacks. 




The number of arrests linked to right-wing 
terrorism remained relatively low but increased 
for the third year in a row. Right-wing extremists 
prey on fears of perceived attempts to Islamicise 
society and loss of national identity. The violent 
right-wing extremist scene is very heterogeneous 
across EU Member States. 
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With regard to terrorism trials concluded in 2018, 
jihadist terrorism convictions remained the highest 
in number; but there was a noted increase in left- 
wing and right-wing terrorism convictions. 


The number of European foreign terrorist fighters 
travelling, or attempting to travel to conflict zones 
was very low. The focus of jihadist networks in EU 
Member States has shifted towards carrying out 

activities in the EU. 



08 . 


There is continued concern that individuals with 
a criminal background, including those currently 
imprisoned, are vulnerable to indoctrination and 
might engage in terrorism. 


The number of individuals returning to the EU 
also remained very low. Hundreds of European 
citizens - including women and minors, mainly 
of a very young age - remain in detention in the 
Iragi and Syrian conflict zone. While minors are 
essentially victims, there are concerns among EU 
Member States that they have been exposed to 
indoctrination and training in former IS territories 
and may pose a potential future threat. 


09 . 



IS succeeded in maintaining an online presence 
largely thanks to unofficial supporter networks 
and pro-IS media outlets. Pro-IS and pro-al- 
Qaeda channels promoted the use of alternative 
platforms and open source technologies. 


Outside Europe, al-Qaeda continued to exert 
power and influence in conflict areas, partly at 
the expense of IS affiliates. Al-Qaeda affiliates 
exploited political grievances at local and 
international level, including in messages directed 
at European audiences. 


11 . 
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Executive 


In 2018, all fatalities from 
terrorism were the result of 
jihadist attacks: 13 people lost 
their lives. In addition, 46 people 
were injured in jihadist attacks. 
This is a considerable decrease 
compared to 2017, when ten 
attacks killed 62 people. In 2018, 
EU Member States reported 
16 thwarted jihadist terrorist 
plots, a fact that indicates both 
continued high terrorist activity 
and illustrates the effectiveness 
of counter terrorism efforts. 


All jihadist terrorist attacks were 
committed by individuals acting 
alone and targeted civilians and 
symbols of authority. Often the 
motivation of the perpetrator 
and the links to other radicalised 
individuals orterrorist groups 
remained unclear. Mental 
health issues contributed to the 
complexity of the phenomenon. 


Completed jihadist attacks 
were carried out using firearms 
and unsophisticated, readily 
available weapons (e.g. knives). 
The diminished sophistication 
in the preparation and execution 
of jihadist terrorist attacks 
contributed to a lower number 
of casualties in completed 
attacks. Several disrupted 
terrorist plots included the 
attempted production and use 
of explosives and chemical/ 
biological materials. There was 
also an increase in the use of 
pyrotechnic mixtures to produce 
improvised explosive devices 
(IED) in jihadist plots. Three 
terrorist plots involving CBRN 
materials were disrupted in 2018 
in the EU. A general increase 
of CBRN terrorist propaganda, 
tutorials and threats was 



The situation in Europe with 
regard to jihadist terrorism 
continued to be influenced 
by external developments. 
Ungoverned spaces in conflict 
areas, including Afghanistan, 
Libya, the Sahel region, Syria and 
Yemen provide opportunities 
for jihadist groups to establish 
control over territories that can 
later turn into safe havens. The 
year 2018 saw a decrease in 
the activities of the so-called 
Islamic State (IS) affiliates in a 
number of regions outside the 
EU. EU Member States assessed 
that IS' diminishing territorial 
control is likely to be replaced 
by increased al-Caeda efforts 
to reclaim power and influence 
in the area. Al-Caeda's strategy 
relied on building alliances with 
local tribes while exploiting 
political grievances at local and 
international level, including in 
Europe. 


























The military defeat of IS in Iraq 
and Syria had a significant 
impact on the group's digital 
capabilities. In parallel, the 
coherence of IS narratives 
was compromised by the 
group's inability to internally 
unify its ideological positions. 
Nevertheless, IS succeeded in 
maintaining an online presence 
largely thanks to unofficial 
supporter networks and pro- 
IS media outlets. Both IS and 
al-Qaeda continued to seek 
out new online vectors for their 
propaganda. In particular, they 
promoted the use of alternative 
platforms and open source 
technologies. 


While IS online propaganda 
remained technologically 
advanced, and hackers 
appeared to be knowledgeable 
in encrypted communication 
tools, the group's cyber-attack 
capabilities and techniques 
were rudimentary. In addition, 
no other terrorist group with a 
demonstrated capacity to carry 
out effective cyber-attacks 
emerged in 2018. 


Despite the degradation of IS' 
organisational structures, the 
group maintains the intent to 
conduct attacks outside conflict 
zones, potentially using former 
members and individuals 
inspired by propaganda. There is 
a continued risk that individuals 
with criminal background, 
including those currently 
imprisoned, are vulnerable to 
indoctrination and might engage 
in terrorism. 


The number of European foreign 
terrorist fighters travelling, or 
attempting to travel to the Iraqi 
and Syrian conflict zone in 2018 
was very low. Cases of traveling 
to alternative areas of conflict 
were reported, although current 
numbers also appear to be very 
low. Rather than attempting to 
travel to the conflict zone, the 
focus of jihadist networks in 
EU Member States has shifted 
towards carrying out activities in 
the EU - both online and offline. 
Jihadists continued to be inspired 
by IS propaganda but also 
consumed propaganda produced 
by other groups claiming to 
defend Islam against a global 
attack, including al-Qaeda. 


The number of individuals 
returning to the EU remained very 
low, with hundreds of European 
citizens remaining in detention 
in Iraq and Syria. All men and 
some women are believed to 
have received weapons training, 
with men also acquiring combat 
experience. While minors are 
essentially victims, there are 
concerns among EU Member 
States that they have been 
exposed to indoctrination and 
training in former IS territories, 
and may pose a potential future 
threat. The abuse of migration 
flows by terrorists to enter the EU 
does not seem to be systematic. 



As in previous years, ethno- 
nationalist and separatist 
terrorist attacks in the EU 
greatly outnumbered other types 
of terrorist attacks in 2018. 

The number of left-wing and 
right-wing attacks and arrests 
remained relatively low and was 
limited to a small number of 
countries. However, the number 
of arrests linked to right-wing 
terrorism, while remaining 
relatively low, continued to 
increase strongly, effectively 
doubling for the second year 
in a row. Right-wing extremists 
exploit fears of perceived 
attempts to Islamicise society 
and grievances linked to an 
alleged loss of national identity. 
The violent right-wing extremist 
scene is very heterogeneous on 
the national level and among EU 
Member States. 


Hawala banking continued to 
be an important instrument in 
terrorism financing. The misuse 
of credit systems, non-profit 
and charity organisations, and 
small-scale business ventures in 
fundraising for terrorism remain 
a matter of concern. 


With regard to terrorism trials 
concluded in 2018, jihadist 
terrorism convictions remained 
the highest in number; 
nevertheless, there was also a 
noted increase in left-wing and 
wing terrorism convictions. 
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Terrorist attacks 
and arrests 


Attacks and arrests by EU Member 
State in 2018. 



total 
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Attacks 


In 2018, a total of 129 foiled, failed 
and completed attacks were reported 
by EU Member States. 


The United Kingdom 1 (UK) experienced the highest number 
of attacks in total (60), followed by France, Italy, Spain, 
Greece, the Netherlands, Germany, Belgium, and Sweden 2 . 


1 Of the attacks reported by the UK, 56 were acts of security-related incidents in 
Northern Ireland, including one attack on national security targets. 

2 For detailed information, see Annex 2. 


Failed, foiled or completed attacks in the EU per 
affiliation/Member State in 2018. 


Terror attacks by affiliation 



mUll H 

UK France Spain NL DE BE SE Italy Greece 

60 30 11 4 2 1 1 13 7 


Terror attacks by Member State 
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The total number of attacks decreased 
after a sharp spike in 2017, primarily 
because of the decrease in reported 
separatist-related incidents. 


Overall, attacks specified as ethno-nationalist 
and separatist continued to represent the largest 
proportion. As in previous years, the countries 
reporting terrorist attacks linked to separatist 
terrorism were the UK (56), France (20) and Spain (7) 


Terrorist attacks in the EU by affiliation, 
2015-2018. 


■-■211 


Number of attacks 

total 


.-■142 



2015 2016 2017 


|~ai29 

2018 


Jihadist 


Left-wing 


17 


13 


13 


27 


Right-wing • 9 


• 1 



33 


24 


• 5 


24 


19 


• 1 


Etno-nationalist 65 99 137 83 

and separatist 
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In 2018, the number of foiled, failed and completed 
jihadist terrorist attacks decreased significantly 
compared to 2017, from 33 to 24. 

This number includes 16 incidents reported by France (7), the UK (3), the 
Netherlands (2), Germany (2), Italy (1) and Sweden (1) as foiled terrorist plots. 
Notably, for the second year in a row, the number of reported foiled terrorist attacks 
outnumbered the completed attacks. 

Similarly to 2017, Greece, Italy and Spain were the targets of attacks carried out by 
left-wing and anarchist terrorists. One right-wing attack was noted by Italy. 


Jihadist terrorist attacks 2017-2018 



n 

!i 


In 2018, 13 victims died 
as a result of terrorist 
attacks and 53 people 
were injured. Similar 
to previous years, all 
reported fatalities and 
the vast majority of 
casualties were caused 
by jihadist terrorists. 


2017 


2018 



failed 12 1 




In terms of weaponry, 
the use of firearms and 
explosives continued 
to prevail, in particular 
in separatist and 
anarchist-affiliated 
attacks. 


o 

Civilians, private 
businesses and 
public institutions 
were among the most 
frequent targets. 


24 


total 
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Arrests 

Similar to the trend observed 
in previous years, most arrests 
in 2018 were related to jihadist 
terrorism (511 out of 1056). 


In 2018,1 056 individuals were arrested in the EU on suspicion of 
terrorism-related offences, with the highest number of arrestees in 
France (310) and in the UK (273 3 ). The number slightly decreased 
compared to 2017 but remained close to the average of recent years. 


3 The number excludes 148 arrests made in Northern Ireland. 


Arrests in the EU 
for terrorism-related 
offences, 

2015-2018 

| Total 

| Jihadist 


1 219 


1 077 

1 002 


1 056 








687 


718 


705 









511 


2015 2016 2017 2018 


Arrests in the EU 
for terrorism-related 
offences by Member 
State in 2018 


Total 
1 056 


France 

310 


United Kingdom 

273 






















general overview 


16 


The number of arrests related to left-wing and right-wing 
terrorism remained comparatively low, however the number 
of right-wing terrorist arrests continued to increase for the 
third consecutive year. 


Arrests in the EU 
for right-/left-wing 
terrorism-related 
offences, 
2015-2018 

Right-wing 
Left-wing 



67 



2015 2016 2017 2018 


111 

In 2018, most arrests were made 
on suspicion of preparing or 
attempting to commit a terrorist 
act; membership of a terrorist 
group, including while being 
abroad; and financing terrorism. 



The average age of those arrested 
was 33, with almost half of the 
suspects being younger than 
30, and 22 % older than 40. As in 
previous years, the suspects were 
predominantly male. 


The majority of arrestees were 
EU citizens, with female suspects 
more likely to possess EU 
citizenship. In most cases, the 
country of birth was the same as 
that of citizenship. 
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Terrorist and violent 
extremist activities 

Financing of terrorism 


The majority of terrorist acts 
committed in 2018 required 
minimal or no financing and were 
unsophisticated in their preparation 
and execution. The perpetrators 
themselves were able to provide the 
funds for such attacks in various 
ways, without leaving traces. 

Whenever external funding is needed, 
diverse methods are employed, 
from the basic to the highly 
complex. Funds may be generated 
by terrorist organisations from 
illegal activities, e.g. extortion and 
the smuggling of migrants. Many 
terrorist organisations, however, have 
legitimate businesses from which the 
proceeds are diverted to terrorism 
purposes. Small-scale business 
ventures are also assessed to be used 
for the financing of terrorism. Terrorist 
funding has also occurred through 
loans and credit which are not paid 
back. 

Terrorist groups have been observed 
to use charities and fundraising 
organisations to extract funds from 
communities underthe umbrella 
of humanitarian aid, for instance, 
to support families and orphans of 
killed fighters, and to build mosques 
and wells. Furthermore, non-profit 
organisations may be used for money 
laundering. 

The Partiya Karkeren Kurdistan 
(PKK, Kurdistan Workers' Party) is 
known to collect money in Europe 
from membership fees, the sale of 
publications, public events (concerts, 
etc.) and annual fundraising 
campaigns. Belgium reports the 
sentencing in 2018 of four individuals 


© 

Hawala banking continued 
to be an important 
instrument in the 
financing of terrorism 


Terrorists continued using 
non-profit organisations 
to raise funds for terrorist 
purposes from Muslim 
communities 


for participating in a 'Kampanya' 
(fundraising campaign). The money 
collected is believed to having been 
used to finance the functioning of the 
many PKK media and the functioning 
of the organisation, the purchase 
of equipment to support the PKK 
military camps, the purchase of 
weapons for the guerrillas and also 
the organisation of attacks on Turkish 
territory. 

Money transfer systems such as 
hawala 4 continue to be an important 
instrument in terrorism financing. 

The core of the 'underground 
banking' systems is the specifics 
of the financial and interpersonal 
relationships and is highly adaptable 
to conditions of conflicts/war and 

4 Hawala is an informal method of money transfer 
based on trust and honour, operating outside the 
traditional banking system, whereby money is paid 
to a network of brokers (known as a hawaldars). 


economic sanctions. This manner of 
conducting business, ethnic-oriented 
and based on trust, is a suitable 
channel to move and provide finances 
for terrorist purposes. Nevertheless, 
an important note has to be made 
- the underground banking is 
profit-oriented. The connections 
and the possibility for support from 
'underground banking'to terrorist 
organisations is undoubtedly an 
important aspect, but not the 
main purpose of existence of the 
'underground' financial system. 

A number of investigations in the 
EU Member States demonstrated 
how the issues of money laundering, 
human trafficking and migrant 
smuggling and terrorism financing 
interlinked. Italy, for example, reported 
the arrests of four individuals in 
2018 on suspicion of transferring 
money to Syria, originating both from 
spontaneous donations of Syrian 
individuals living in various European 
countries and from proceeds 
generated by smuggling of migrants 
from the Middle East to Northern 
Europe. Part of the money involved 
was to be used to fund a terrorist 
organisation affiliated to al-Qaeda 
operating in Syria. 

Both surface- and dark-web sites are 
used to request online donations, 
including virtual currencies. The 
most common crypto currency 
appears to be Bitcoin. One example 
of fundraising campaigns through the 
dark-web is the one done via Sadaqa 
Coins, a crowdsourcing project that 
allegedly supports jihadist groups in 
Syria. Since the areas in Africa, the 
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Middle East orthe Caucasus region to 
which the funds have been remitted 
may be under control of terrorist 
groups, it is difficult to assess where 
the funds really end up. 

Explosives 

The key threat in Europe related to 
the unlawful use of explosives in 
the form of bomb attacks continued 
to emanate from groups or lone 
actors linked to jihadist terrorism. 

Even though 2018 did not witness 
a completed jihadist bomb attack, 
information collected during 
investigations into a considerable 
number of disrupted terrorist plots 
revealed plans and preparatory acts to 
utilise this type of weapons. However, 
in 2018, the number of jihadist 
bomb attacks and plots decreased 
compared to 2017. 


© 

Most explosives in 
incidents linked to jihadist 
terrorism were homemade 


The use of low explosives 
and pyrotechnic mixtures 
increased 


Homemade explosives (HMEs) were 
still used in most known explosive- 
related incidents linked to jihadist 
terrorism. Regarding the type of 
HMEs, a shift from the previously 
predominant use of triacetone 
triperoxide (TATP) to a broader range 
of HMEs was noted - in particular, 
low explosives such as black powder, 
chlorate mixtures and fertilisers- 
based mixtures. 

Control measures have made 
procurement of precursors for the 
production of TATP increasingly 
difficult. In 2018, there were 
indications of attempts to use 
alternative explosive precursors for 
its manufacture. In addition, some 
investigations indicated the use of 
TATP in combination with other types 
of explosive materials, in order to 
enhance the power and lethal effects 
of the improvised explosive devices 
(lEDs). Failures in using TATP by 
terrorists in the second half of 2017 
(incidents during TATP manufacture 


and malfunctions of lEDs with 
TATP charges) 5 appeared to have 
accelerated these developments. 

In parallel, an increased use of 
pyrotechnic mixtures (mainly 
fireworks) - obtained legally or, 
more often, illegally - was observed 
in jihadist terrorist attacks and 
plots. In order to reduce availability 
and misuse of illegal pyrotechnics, 
international law enforcement 
operations in 2018 targeted and 
successfully disrupted complex 
organised crime groups (OCGs) 
dealing with the illegal production and 
sale of pyrotechnics across the EU 6 . 

Notably, attempts to use lEDs in 
combination with chemical or 
biological toxins were observed in 
2018, something that has long been 
promoted in jihadist propaganda and 
lED-making manuals. 

In most cases, knowledge transfer 
with regard to HME and IED 
production was facilitated by the 
use of online, often encrypted, 
social networks and forums. While 
there were still cases of targeted 
instructions or remote assistance by 
virtual advisors on encrypted social 
platforms, an increasing trend of 
collecting bomb-making knowledge 
from readily available online open 
sources (for example, pyrotechnic 
and explosive enthusiast sites and 
forums) was noted. 

The explosive-related jihadist plots 
in 2018 were aimed at soft targets 
and mass gathering locations (public 
events, shopping areas, bars and 
clubs, etc.). 

5 For example, the explosion of the HME laboratory 
in Alcanar, Spain, August 2017; and the above¬ 
ground Parsons Green Underground station 
bombing in London, UK, September 2017. 

6 See, for example, Eurojust and Europol joint press 
release "International cooperation disrupts illegal 
fireworks network", 6 December 2018, http:// 
www.eurojust.europa.eu/press/PressReleases/ 
Pages/2018/2018-12-06.aspx. 
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In contrast, targets chosen by 
anarchist extremist groups were 
mostly state, financial, military, or law 
enforcement targets. For example, 
there was an incident in Italy where 
police first responders attending a 
crime scene of an explosion were 
targeted with a secondary victim- 
operated IED. lEDs used in anarchist 
attacks were made from an array 
of readily available materials. As in 
previous years, in 2018 the anarchist 
groups utilised simple improvised 
incendiary devices (IIDs) filled with 
flammable liquids or lEDs filled with 
easily accessible explosive materials, 
such as pyrotechnic mixtures (flash 
powder or black powder). 

The attack methodologies and 
capabilities used by Dissident 
Republican (DR) groups in Northern 
Ireland (UK) vary across the groups. 
Many attacks involved firearms or 
small lEDs such as pipe bombs, but 
they also deployed larger and/or 
potentially more destructive devices 
such as vehicle-borne lEDs (VBIEDs) 
and explosively formed projectiles 
(EFPs). 


Chemical, 
biological, 
radiological and 
nuclear (CBRN) 

In 2018, three incidents involving 
the use of chemical, biological, 
radioactive or other nuclear (CBRN) 
materials were reported in the EU. In 
May 2018, an Egyptian national was 
arrested in France on suspicion of 
preparing a terrorist attack. At his 
apartment in Paris, black powder 
extracted from pyrotechnics and 
several tutorials explaining how to 
make an IED and how to use ricin to 
commit a terrorist attack were found. 

In June, a terrorist plot using ricin 
was uncovered in Cologne (Germany). 
Police found a large number of castor 
beans and a quantity of already 
produced ricin in an apartment of a 
Tunisian citizen. The suspect who was 
allegedly inspired by IS, was planning 
to combine the ricin with explosives, 
ball bearings and bladed weapons. 

In the context of the investigation his 
wife was also arrested. 


© 

Three terrorist plots 
involving CBRN materials 
were disrupted in 2018 in 
the EU 


A general increase 
of CBRN terrorist 
propaganda, tutorials and 
threats was observed 

In November, in Sardinia (Italy) a 
Lebanese citizen was arrested for the 
preparation of a chemical-biological 
plot. Elis aim was to produce a 
mixture of lethal poisons in order to 
contaminate drinking water. The case 
was linked to the arrest of another 
individual in Lebanon suspected of 
planning to poison the water supply of 
the Lebanese Armed Forces. Despite 
the high toxicity of the substances 
involved, to date these have not been 
associated with any terrorist attack. 
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Online discussions of planning 
CBRN attacks increased in 2018. 

As in previous years, intentions to 
use CBRN materials were expressed 
mainly byjihadists. Closed forums 
were used to propose possible 
modi operandi, share instructions to 
produce and disperse various agents 
and to identify high-profile targets. 
However, the technical information 
was not always accurate. 

In July and August 2018, IS-linked 
group al-Abd al-Faqir Media (AF 
Media) launched a campaign titled 
Bio-Terror via Telegram promoting 
the use of biological weapons. 

A number of videos, posters and 
infographics contained instructions, 
albeit inaccurate, for manufacturing 
biological agents and providing 
instructions on how to obtain and 
deploy the microorganisms 7 . 

The barrier for gaining knowledge 
on the use of CBRN weapons 
has decreased. The handling and 
containment of biological agents, 
which used to be a major challenge, 
has become more feasible. Dual- 
use equipment and materials (e.g. 
laboratory kits or home cleaning 
products) are easily accessible. In 
2018, the procurement of biological 
toxins, such as abrin and ricin, 
through online and underground 
marketplaces continued to be a trend. 
There were no reports of terrorist use 
of radioactive isotopes or nuclear 
material in 2018. 



' The information contained in the Bio-Terror video 
released during this campaign about the production 
of deadly microorganisms - petalominium - was 
very basic and with several mistakes indicating 
poor knowledge of microbiology. The information 
provided was therefore considered not enough to 
weaponise the microorganisms concerned. 


There has been m 
and speculation over the past few 
years that terrorists could turn to 
launching cyber-attacks against 
critical infrastructure. However, 
while the so-called Islamic State 
(IS) online propaganda appears 
technologically advanced and 
their hackers may be well versed in 
encrypted communication tools, their 
cyber-attack tools and techniques 
remain rudimentary. They stil 
purchase doma 

downloading software and renting 
botnets for distributed denial-of- 
service (DDoS) attacks rather than 
developing their own cyber weapons. 


er and terrorism 


IS sympathisers have successfully 
carried out a small number of 
defacements and low-level hacks 
and in March 2018, IS supporters 
attempted to come up with an 
alternative to Facebook. Dubbed 
the Muslim's Network, it was made 
available in Arabic, English and 
French. However, the platform was 
not an in-house development but had 
chased online for a small 
f money. 
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Convictions and 
penalties 


Number of individuals in concluded court proceedings for terrorist 
offences in 2016, 2017 and 2018, as reported to Eurojust*. 



In 2018,17 EU Member 
States reported a total 
of 653 individuals 
who were convicted or 
acquitted of terrorist 
offences 8 . This number 
is higher than the 
numbers reported over 
the past two years 9 . 


8 Eurojust received contributions containing 
information on terrorism-related court decisions 
in 2018 from the following EU Member States: 
Austria, Belgium, Bulgaria, Czechia, Denmark, 
Finland, France, Germany, Greece, Hungary, 

Italy, Lithuania, the Netherlands, Slovenia, Spain, 
Sweden and the UK. If a verdict pronounced in 
2018 was appealed and the appeal was concluded 
before the end of the year, Eurojust reported only 
on the latest/final verdict. 

9 Please refer to Annex 4 for additional information 

on the numbers mentioned in this section. 


In 2018, France was the Member State 
that reported the highest number 
of individuals in concluded court 
proceedings for terrorist offences 
(141), followed by Spain (120), the UK 
(115) and Belgium (80) 10 . In Greece, 
ten individuals were tried more than 
once during the year in different 
terrorism proceedings. As a result, the 
total number of verdicts pronounced 
for terrorism-related offences in 2018 
was 664. 

Some of the defendants who 
appeared before courts in the EU 
Member States were minors at 
the time of trial and/or when the 
offences were committed. The 
number of female defendants judged 
in 2018 (94) continued to increase 


10 The UK contribution includes proceedings on 
offences under anti-terrorism legislation, as well 
as other offences assessed to be terrorism-related. 
Similar to previous years, the UK data for 2018 
refers only to convictions. 


as compared to 2017 (66) and 2016 
(53). The practice in some countries, 
such as Belgium, France and the 
Netherlands, to render sentences in 
absentia continued with respect to 
defendants who were believed to be in 
conflict zones or were claimed to have 
died but were not officially declared 
dead. Some individuals sentenced 
for terrorist offences in 2018 had 
previously been convicted of terrorism 
or other offences in the same Member 
State or abroad. 
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Some of the verdicts reported in 2018 
are final while others are pending 
judicial remedy, as appeals have been 
submitted 11 . 

Type of terrorism 

In 2018 the majority (399) of verdicts 
in the EU Member States concerned 
jihadist terrorism confirming a trend 
that started in 2015 12 . Similar to 
the previous years, a large part of 
the verdicts for jihadist terrorism 
concerned offences related to so- 
called Islamic State (IS); however, 
persons linked to al-Qaeda (AQ), the 
Taleban, Al-Shabaab or Hezbollah 
were also tried in 2018. 

Courts in France, Belgium and Spain 
rendered the highest number of 
verdicts concerning jihadist terrorism 
in 2018 (123,76 and 68 respectively). 
Bulgaria, Finland, Italy, Slovenia and 
Sweden reported only verdicts for 
jihadist terrorism in 2018. 

Six defendants appeared before the 
Audiencia Nacional (National High 
Court) in Spain for their alleged 
involvement in a major terrorist 


11 According to Council Decision 2005/671/JHA of 
20 September 2005 on the exchange of information 
and cooperation concerning terrorist offences, 

the information to be submitted to Eurojust is in 
relation to final convictions. Due to the specifics 
of reporting, some EU Member States submit 
information on final decisions only, while other EU 
Member States also report on not final decisions. 
The data provided by the UK did not distinguish 
between final decisions and decisions pending 
judicial remedy. As reported, all convictions in the 
UK are effective from the moment of their being 
pronounced, even if an appeal is made. 

12 The data provided by the UK was not broken 
down by type of terrorism and is therefore not 
included in the numbers in this section. 


network recruiting and sending 
fighters to join jihadist terrorist 
organisations abroad. The network 
had facilitated the integration of 
foreign fighters into al-Qaeda in 
the Islamic Maghreb (AQIM), the 
Movement for Oneness and Jihad 
in West Africa (MOJWA), Jabhat 
al-Nusra and IS, in Mali, Libya, Irag 
and Syria. It had members in Spain, 
Belgium, Luxembourg, Turkey, Tunisia, 
Libya, Mali, France and Morocco, 
all performing different functions, 
including recruitment, document 
forgery, financing, facilitators in the 
destination country and smugglers. 
The court convicted all six defendants 
of terrorist offences. The leader 
of the network was found guilty of 
directing and promoting a terrorist 
organisation, with a mitigating 
circumstance for confessing the 
crime and was ordered to serve eight 
years of imprisonment, followed by 
probation for seven years. Four of 
his co-defendants were convicted of 
belonging to a terrorist organisation 
and received a six-year sentence 
each and a probation period of five 
years upon release. The four had 
also confessed to the crime. The 
sixth defendant was sentenced to 
five years' imprisonment, followed 
by a probation period of five years, 
after the court found him guilty 
of collaboration with a terrorist 
organisation. 

The main living suspect of the 2015 
Paris attacks was sentenced to 20 
years of imprisonment, and a fine 
of EUR 6 000 by the Court of First 
Instance of Brussels for terrorist 
offences unrelated to the attacks. 

The same penalty was handed to his 
co-defendant. Both men had been 
arrested in Brussels on 15 March 
2016 following a shoot-out with the 
police, which had left four officers 



injured. The two were found guilty of 
attempted assassination and illegal 
possession of firearms, both in a 
terrorist context. 

A prison sentence of six years was 
ordered by the District Court of 
Rotterdam in the case of a Dutch 
foreign fighter, who had joined IS 
and is believed to still be in Syria. 

The man, tried in absentia, was 
found guilty of participation in a 
terrorist organisation. He left for 
Syria in November 2013 and has 
been recognised in several videos 
from the conflict zone. The Dutch 
authorities also received information 
from the US Department of Defense 
that an IS registration form in his 
name had been found in October 2015 
in Syria. The court considered the 
form authentic. The defendant had 
been informed of the upcoming court 
hearings via Facebook Messenger. 

He had informed the police of his 
intention to return to the Netherlands, 
which was the reason why a hearing 
had been postponed to allow him to 
be present. Following news in the 
media that the defendant had died in 
battle, a journalist published an article 
claiming he had received an open 
letter from the defendant addressed 
to the judge. The letter claimed 
that, together with his fiancee, he 
had staged his own death to ensure 
his safe trip to the Turkish border. 

It stated further that he would not 
be able to come back for the court 
hearing but would definitely do so if 
he were convicted and need to appear 
before the Court of Appeal. The 
court concluded that the defendant 
had clearly revoked his right to be 
present at the first instance trial. 

When considering the severity of the 
penalty, the court did not take into 
account the fact that the defendant 
had left for Syria in a period when 




less had been known about IS and 
the caliphate had not been declared. 
Furthermore, it considered it an 
aggravating circumstance that the 
defendant had been with IS in a period 
when the terrorist organisation had 
committed an increased number of 
attacks. 

The majority (64) of the female 
defendants were tried for jihadist 
terrorist offences, which also 
presents an increase compared to 
2017 (42). The Court of First Instance 
of West Flanders, Bruges division, in 
Belgium heard the case of a young 
woman charged with participation 
in the activities of a terrorist group. 
The court re-qualified the conduct 
as spreading or making otherwise 
public of a message with the purpose 
of inciting a terrorist offence. In 
particular, the charges referred to 
making propaganda for IS via the 
internet, maintaining contacts with 
fighters in the conflict zone and 
providing moral and financial support 
to French nationals suspected of 
terrorist offences. All activities had 
been carried out over the internet. 

The court found that the defendant 
had been extremely active online and 
had uploaded content, directly and 
indirectly, inciting the commission 
of terrorist acts, including bomb 
attacks. The court found her guilty 
and ordered her to serve four years in 
prison, of which two on probation, and 
to pay a fine of € 2000. 

Five EU Member States (Austria, 


Belgium, France, Germany and 
Spain) reported cases of separatist 
terrorism in 2018. Courts in Spain 
tried the largest number of individuals 
charged with such offences (40). In 
March 2018, for example, the Spanish 
National Court handed a prison 
sentence of almost six years to an 
Euskadi fa Askatasuna (ETA) member 
with several previous terrorism 
convictions. The man was found 
guilty of participation in a terrorist 
organisation. Fie left Spain after 
serving his sentence for a previous 
conviction. Fie settled in France from 
where he made contacts with ETA. Fie 
received false documents and a car 
registration plate and was instructed 
to leave for London, where he was 
hosted by another ETA member. In 
January 2014 the Spanish authorities 
issued a European Arrest Warrant 
in his name. Fie was arrested in 
the UK in February 2016 together 
with another ETA member and was 
later surrendered to the Spanish 
authorities. 

The FHigher Regional Court of Celle 
in Germany found one Turkish 
national guilty of membership in 
a foreign terrorist organisation 
and sentenced him to 18 months' 
imprisonment. The court found that 
the man had belonged to the PKK and 
played a leading role in the terrorist 
organisation's structures in the 
Lohne-Dinklage area between August 
2014 and October 2016. The man 
had also acted as a co-leaderforthe 
region of Oldenburg. 


As in 2017, left-wing terrorism cases 
were brought before the courts 
in Czechia, Greece and Spain in 
2018. The greatest increase was 
seen in Greece, where 33 verdicts 
were handed down, as compared 
to 17 in 2017. The number of 
decisions includes those in which 
the defendants were acquitted. One 
Czech case heard by the FHigh Court 
in Prague was brought against two 
men and three women, accused of 
preparing a bomb attack on a train in 
Czechia. These alleged offences were 
charged as preparation of a terrorist 
attack and categorised as left-wing 
terrorism. The defendants were 
acquitted. 

Germany and the Netherlands 
reported verdicts for right-wing 
terrorist offences and the total 
number of reported verdicts increased 
from four in 2017 to 22 in 2018. In 
Germany, for instance, the Fligher 
Regional Court of Dresden heard the 
case of seven men and one woman 
accused to have formed part of the 
extremist right group Gruppe Freital 
(Freital Group) since July 2015. 

The group's objective was to attack 
asylum seeker accommodation, and 
apartments, offices and vehicles of its 
political opponents. Group members 
had been accused of committing 
a series of bomb attacks in 2015, 
including on the vehicle of a left-wing 
politician and a left-wing party office, 
on a refugee camp and an asylum 
centre. The charges against them 
included leadership or membership 
in a terrorist organisation, multiple 
attempted murders and grievous 
bodily harm. The court found all eight 
defendants guilty and sentenced 
seven of them to prison terms of 
five to ten years, and one to a youth 
sentence of four years. 
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Type of offences 

As in previous years, a large number 
of criminal cases concluded in 2018 
concerned participation in (the 
activities of) a terrorist group. A 
smaller number of the defendants 
in 2018 were tried for glorification of 
terrorism and humiliation of victims 
of terrorism, recruitment and (self- 
) training for terrorist purposes, 
financing of terrorism, travel to a 
zone controlled by a terrorist group, 
instigation to commit terrorist acts, 
etc. or for attempting to commit such 
crimes. In some cases, terrorism 
charges were filed in parallel with 
charges for other offences, e.g. 
murder, manufacture, supply and 
possession of explosives or weapons, 
migrant smuggling, aggravated 
damage to property, and forgery of 
official documents. 

In 2018, several cases concerned 
the preparation orthe commission 
of recent terrorist attacks in 
Europe. In Sweden, for example, 
Stockholm District Court in June 
2018 sentenced an Uzbek national 
to life imprisonment for committing 
terrorist crimes. The defendant, a 
40-year old male, stole a lorry to 
mow down pedestrians in the centre 
of Stockholm on 7 April 2017. The 
incident led to the death of five 
individuals; ten others were injured. 


The man stated that he performed the 
attack on behalf of IS. 

In June 2018, the Varsinais-Suomi 
District Court sentenced the 
perpetrator of a terrorist attack 
in Turku, Finland, in August 2017 
to a cumulative sentence of life 
imprisonment for killing two people 
and injuring eight others. The 
defendant was further liable to pay 
damages to the victims. The court 
found that the defendant had acted in 
the name of IS and that the murders 
and attempted murders had been 
committed with terrorist intent. The 
defendant had intended to cause 
serious fear among the population 
and perceived himself as a promoter 
of IS's cause. He also prepared for 
the attack by sharing a manifest that 
expressed the ideological and political 
background and objectives of IS, as 
well as aspirations to promote its 
goals, with discussion forums on the 
Telegram instant messaging service. 

Life imprisonment, with a minimum 
of 16 years to be served, and a prison 
term of six years and nine months 
were ordered by the Central Criminal 
Court of England and Wales to a 
mother and a daughter who belonged 
to the first female terrorist cell in the 
UK. The daughter had planned to 
carry out a knife attack close House 


of Parliament in London and was 
assisted by her mother. Her sister 
was also convicted of planning to 
commit another attack close to the 
British Museum in London. She was 
sentenced in August to a life term, 
with a minimum of 13 years to be 
served. She had married an IS fighter 
online and had planned to join him 
in Syria before being stopped by 
the security service. The mother is 
believed to have played a major role 
in radicalising her daughters. A fourth 
young woman was also found guilty 
of possessing information about 
terrorist acts. 

Judgments in 2018 continued to 
address the use of social media and 
various other online platforms to 
spread terrorist content, glorify and 
incite the commission of terrorist 
acts. In Spain, the National Court 
heard the case of a Moroccan national 
charged with self-indoctrination. On 
several occasions through the Amaq 
news Agency, the defendant accessed 
propaganda which had been created 
and spread by IS. The defendant's 
radicalisation process was further 
boosted by regularly accessing 
the website Muslim News, which 
contained a depository of numerous 
audio files and roughly 5 000 videos 
with radical jihadist content. The 




defendant admitted to carrying out 
these acts. The court handed down a 
prison sentence of two years and two 
months. 

In Italy, the Milan Assize Court found 
one person guilty of membership 
of a terrorist organisation and 
disseminating, via an app and on the 
internet, material inciting or provoking 
the commission of terrorist acts. The 
court sentenced the man to serve 28 
months in prison after it considered it 
proven that he had publicly instigated 
others to commit terrorist offences. 
The court found that he had praised 
and fostered anti-democratic 
feelings and religious hatred, and 
glorified Jihad and martyrdom. He had 
used multiple Facebook profiles to 
promote terrorist ideology and tools 
to pursue the goals of conquest and 
expansion of IS. The court considered 
the use of IT and electronic means 
of communication an aggravating 
circumstance. 

In the Netherlands, a teenager 
appeared before Rotterdam District 
Court charged with participation in 
the terrorist organisations IS and the 
United Cyber Caliphate (UCC). The 
court heard that between November 
2016 and June 2017 he had made 
and distributed videos on instruction 
from the UCC, as well as other videos 
inciting armed (jihadist) fighting. The 
videos also contained also images of 


executions. The young man regularly 
looked up IS videos, supported their 
actions online, placed IS propaganda 
on the internet and visited websites 
about suicide terrorist attacks. In 
March, he was found guilty and 
sentenced to youth detention of six 
months and 181 days, part of which 
was suspended. 

The female defendants in 2018 were 
tried for leading a terrorist group, 
preparing to commit terrorist acts, 
participating in or collaborating with 
a terrorist organisation, financing 
terrorism, glorification of terrorism, 
spreading messages inciting to 
commit a terrorist offence, among 
other types of offences. 

In Spain, four defendants appeared 
before the National Court charged 
with indoctrination and recruitment of 
supporters to a terrorist organisation. 
The group was led by a woman 
who started the recruitment and 
indoctrination of other women in 
2014 with the intention to reach Syria 
to join IS. She was planning to marry 
one of the other defendants and 
travel with him to Syria. Moreover, 
she maintained a close relationship 
with the other woman in the group 
whose task also concerned the 
recruitment of supporters as well 
as the management of WhatsApp 
groups. To indoctrinate and recruit 
of supporters, they first used 


Facebook and once contact with the 
person was satisfactory, they would 
use WhatsApp to continue with 
indoctrination. This process prompted 
the recruitment of at least three young 
people of Moroccan nationality. The 
defendants were sentenced between 
four and seven years imprisonment. 

The Spanish National Court found 
another woman guilty of collaboration 
with a terrorist organisation and 
sentenced her to two years in prison. 
She had prepared to leave for Syria 
to marry a man who was presumably 
a member of IS. The defendant tried 
to help him come back to the EU by 
providing a false passport. 

In 2018, courts in several EU Member 
States handled cases against 
defendants who were under legal 
age at the time the offences were 
committed. In Germany, the Higher 
Regional Court of Hamburg sentenced 
three Syrian nationals to years-long 
imprisonment for membership in a 
foreign terrorist organisation (IS) and 
(attempted) document forgery. The 
first defendant was sentenced to six 
and a half years imprisonment. The 
other two were minors at the time of 
the offence and as such received a 
juvenile penalty of three and a half 
years each. The court found that the 
three had been part of an IS 'sleeper 
cell'. The terrorist organisation 
had arranged for them to travel to 


- genera 


general overview 



26 




Germany with fake passports, cash 
and mobile phones in 2015 and 
awaited orders for an attack. 

An Austrian court sentenced a 
16-year-old minor to ten months 
imprisonment with a probationary 
period of three years. The minor, who 
is a Serbian national, was indicted 
for membership in a terrorist and 
criminal organisation, as well as for 
the endorsement of terrorist offences. 
The crimes were committed by 
actively participating in chat groups 
disseminating jihadist propaganda 
and setting up plans to travel to Syria 
in order to join IS. 

Convictions and 


acquittals 


In 2018, seven EU Member States 
reported that all terrorism verdicts 
had resulted in convictions, while 
others reported both convictions and 
acquittals 13 . Successful prosecutions 
resulting only in convictions were 
concluded in Bulgaria, Denmark, 
Finland, Hungary, Italy, Lithuania, 
Slovenia and Sweden; whereas 
France, Germany and Greece had a 
very low percentage of acquittals 
securing convictions for the vast 
majority of those tried for terrorist 


2018 data for the UK refers only to convictions 
and is not included in the numbers in this section. 


offences in 2018. In some cases, 
defendants were acquitted of terrorist 
offences but convicted of other 
offences, such as drug trafficking and 
document fraud 14 . 

Similar to 2017, all prosecutions 
for right-wing terrorist offences in 
2018 resulted in convictions. The 
percentage of convictions among the 
verdicts for jihadist terrorism in 2018 
remained very high (89 %, the same 
as in 2017). The conviction rate for 
separatist terrorist offences remained 
the same as in 2017 (71 %), while 
that for left-wing offences decreased 
slightly (from 72 % in 2017 to 70 % in 
2018 ) 15 . 

Penalties 

The average prison sentence for 
terrorist offences in the EU in 2018 
was seven years, which is higher 
than in 2016 and 2017 (five years) 16 . 


14 Eurojust considers it one verdict if an individual is 
convicted of more than one terrorist offence within 
the same proceeding, or convicted of a terrorist 
offence and acquitted of another offence. If an 
individual is acquitted of a terrorist offence and 
convicted of another offence, the verdict is included 
in the overview as acquittal of terrorism. 

15 The data provided by the UK was not broken 
down by type of terrorism and is therefore not used 
to calculate the conviction rate. 

16 For the purpose of the calculation of the average 
prison sentence, penalties exceeding 40 years of 
imprisonment and life sentences were counted as 
40 years. In the cases where the court ordered a 
minimum number of years of the life sentence to be 
served, the sentence was included in the overview 
with the minimum number of years indicated. 


The lowest prison sentence ordered 
by courts in the EU Member States 
in 2018 was three months and 
the highest was 535 years. Two 
such penalties of 535 years of 
imprisonment were given to two ETA 
members in Spain, who placed an 
explosive device in a busy Madrid 
street. Many people were injured 
and material seriously damaged as a 
result. 

More than half (59 %) of the penalties 
handed down with guilty verdicts in 
2018 were of imprisonment of up to 
five years, which presents a slight 
decrease compared to 2017 (61 %), 
while sentences often and more 
years of imprisonment increased 
from 12 % in 2017 to 15 % in 2018. 

In several cases in Austria, Finland, 
Germany, Sweden and the UK the 
courts ordered life sentences for the 
committed terrorist offences. 

It should, however, be taken into 
consideration that the severity of the 
penalty in each case would depend on 
the respective offence and specific 
circumstances and cannot serve any 
comparative purposes. In addition, in 
some EU Member States the average 
sentence is calculated on the basis 
of one conviction, while in others it 
is based on a considerably higher 
number of convictions. 

Similarto 2017, the highest average 
prison sentence was ordered for 
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left-wing terrorist offences and 
increased from ten to 16 years. The 
average prison term for separatist 
and right-wing terrorist offences 
increased from four to eight and six 
years respectively. As in the past two 
years, the average prison sentence for 
jihadist terrorist offences remained 
five years 17 . 

in some cases, in addition to the 
prison terms ordered by the court, the 
convicted individuals were subjected 
to mandatory psychotherapy, 
or admitted in a mental health 
institution. Furthermore, additional 
penalties included fines, restrictions 
on exercising certain civil rights 
or working in certain sectors (e.g. 
education), travel bans, expulsion 
from the national territory, fixed 
probationary period upon release, etc. 
In France, most of those convicted 
were entered into the national judicial 
database for terrorist offences and 
in the UK, terrorist offenders were 
subjected to counter terrorism 
registration. In some cases, juvenile 
penalties were given or the sentence 
was partially or fully suspended. In 
other cases, the sentencing or the 
execution of the prison sentence was 
postponed upon certain conditions, or 
the penalty was still to be determined 
by the judge at the time of reporting. 

In the cases when courts in the EU 
Membr States did not impose a prison 
term, they ordered other penalties, 
such as community service, fines, 
referral orders in case of minor 
offenders, etc. 
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17 The data provided by the UK was not broken 
down by type of terrorism and is therefore not 
included in the overview. 
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Average* sentences (excluding 
non-prison penalties) per 
Member State in 2018, as 
reported to Eurojust. 


Average sentence in years 


* The average sentence in Bulgaria, Czechia 
and Slovenia is based on one conviction 
in each country. In Finland and Sweden, 
only one penalty of life imprisonment 
was ordered by the national courts and is 
therefore not included in the overview. 
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jihadist terrorism 



Number of suspects arrested for religiously 
inspired/jihadist terrorism from 2014 to 
2018. 
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Terrorist attacks and 
suspects arrested in 
the EU 


© 

Seven completed jihadist 
terrorist attacks were 
carried out and one attack 
failed in five EU Member 
States. Sixteen jihadist 
plots were successfully 
thwarted 


Thirteen people were 
killed and 46 injured in 
jihadist attacks in 2018 


All completed jihadist 
terrorist attacks in 2018 
were perpetrated by lone 
actors 


In 2018, there were seven completed 
jihadist terrorist attacks: three in 
France, two in the Netherlands, one 
in Belgium and one in the UK; one 
jihadist attack failed in Spain. In 
addition, another 16 incidents were 
reported as foiled jihadist terrorist 
plots. A total of 13 people were killed 
and 46 injured in jihadist attacks in 
2018. The casualties included 12 
police officers, three of whom were 
killed. 

France, the Netherlands and the 
UK witnessed the highest number 
of attacks and the highest rate of 
successfully foiled terrorist plots. 
France, Germany and Italy reported 
disrupted terrorist plots involving the 
attempted use of chemical and/or 
biological materials 18 . 

The completed and failed jihadist 
attacks were mostly carried out 
using knives and firearms, and 
predominantly targeted civilians. 

All attack plots involving the use of 
explosives were disrupted. 

The majority of the perpetrators were 
acting or were planning to act alone. 
Flowever, several foiled terrorist plots, 
including two in the Netherlands, were 
prepared by individuals acting in a 
group. 


18 See chapter Chemical, biological, radiological and 
nuclear (CBRN). 


In 2018, a total number of 511 19 
individuals were arrested on suspicion 
of offences related to jihadist 
terrorism. Most arrests occurred in 
France, the UK and Belgium, followed 
by the Netherlands, Germany and Italy, 
in descending order. More than half of 
the suspects, both men and women, 
were arrested on suspicion of being a 
member of a terrorist group, including 
while abroad, and participation in 
attack planning and preparation. 

EU and non-EU citizens were almost 
equally represented among jihadist 
arrestees and attack perpetrators. 
Among this population, non-EU-born 
individuals were slightly prevailing. 

The average age of attackers was 
26, while the individuals arrested for 
terrorist offences were older, with the 
average age being 32. The attackers 
were all male. Women accounted for 
22% of arrestees suspected of jihadist 
terrorism, as compared to 16 % in 2017 
and 26% in 2016. 20 


19 See Annex 3. 

20 These figures are calculated excluding data 
contributed by the UK and partially Belgium, which 
are not broken down to type of terrorism. 
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The following is an overview of the COMPLETED JIHADIST TERRORIST ATTACKS in 2018, four of 
which were claimed by the so-called Islamic State (IS): 



On 23 March, a 26-year-old Moroccan male hijacked a car in Carcassonne 
(France), killing the passenger and wounding the driver. Later, he shot 
and wounded four police officers nearby military barracks, and attacked 
a supermarket in Trebes, where he killed two civilians, injured several 
others and held the customers hostage. A lieutenant colonel of the French 
National Gendarmerie, who exchanged himself for a hostage, was shot 
and stabbed by the perpetrator and died later from his injuries. The special 
task force of the French National Gendarmerie killed the attacker. IS 
claimed in an Amaq News release that he was 'a soldier of IS'; 



On 5 May, a man stabbed and seriously injured three people in The Flague 
(the Netherlands) before being shot and arrested by police. The authorities 
later assessed that he had a terrorist motive; 



On 12 May, a 20-year-old French citizen of Chechen origin armed with a 
knife killed one person and injured several more in Paris (France), before 
being shot dead by police. IS claimed responsibility for the attack through 
Amaq News affirming that the attacker was 'a soldier of IS', and released a 
video of the attacker pledging allegiance to IS; 



On 29 May, a 31-year-old man who was released from prison on parole the 
day before, stabbed two female police officers and took one of their guns 
in Liege (Belgium). Fie used the handgun to shoot and kill both officers 
and the passenger of a car, and to wound four other police officers when 
exiting the school building where he had briefly held a woman hostage. 
The attacker was killed by police, and the following day IS claimed 
responsibility for the attack through Amaq News. The perpetrator had 
converted to Islam and had been radicalised to violence while serving a 
sentence for drug offences; 
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On 31 August, a 19-year-old Afghan national who had applied for asylum 
in Germany stabbed and severely wounded two American tourists in 
the Amsterdam central railway station (the Netherlands), before being 
shot and arrested by police. The authorities later assessed that he had a 
terrorist motive; 



On 11 December, a 29-year-old French national of Algerian descent armed 
with a gun and a knife killed five people and injured others in an attack 
near Strasbourg Christmas market (France). Fie was wounded by police 
before fleeing the scene. After a two-day search, the perpetrator was 
killed in Strasbourg and IS claimed that the perpetrator was an 'IS soldier' 
through ar\ Amaq News statement on 13 December. Several people were 
arrested in connection with the attack, including the individual who 
allegedly supplied the attacker with a firearm; 



On 31 December, a 25-year-old man of Somali origin armed with a 
kitchen knife stabbed and injured three people including a police officer 
at Victoria station in Manchester (UK). The attacker was arrested, and 
the authorities later assessed that he had a terrorist motive. 


In addition, Spain reported an incident 
in 2018 as a failed attack: on 20 
August, a 29-year-old Algerian male 
entered a police station in Barcelona 
(Spain) wielding a knife and reportedly 
shouting 'Allahu akbar' (God is 
great). Fie was shot and killed after 
he attempted to stab a police officer. 
The incident occurred three days 
after the anniversary of the attacks in 
Barcelona and Cambrils in 2017 and 
around the time of the Islamic feast of 
Eid al-Adha. 

EU Member States also reported 
that 16 terrorist plots were foiled. 

The decrease in the number of 
completed jihadist terrorist attacks 


in the EU is at least partly the result 
of effective intelligence and law 
enforcement operations, illustrated 
by the relatively high number of 
reported foiled attacks. In September 
2018, for example, the Netherlands 
successfully thwarted a major attack 
involving seven men who had reached 
an advanced stage in their planning. 
Three of the suspects had previously 
been arrested for attempting to travel 
abroad as foreign terrorist fighters 
(FTFs). 

All attacks completed in 2018 were 
perpetrated by lone actors and not by 
groups. Lone actors, however, seldom 
act in total isolation. They often 


maintain relations in loose networks 
or small unstructured groups, and may 
receive material and/or moral support 
from like-minded individuals. It is 
not always self-evident whether the 
individual is a dedicated jihadist acting 
on radical beliefs, or someone who 
suffers from mental health issues. For 
instance, neither the motivation nor 
the trigger for the stabbing of three 
people in The Flague (the Netherlands) 
on 5 May was immediately clear. 

The perpetrator was known to police 
due to his prior behaviour, but the 
prosecution concluded, based upon 
his own statements and recorded 
conversations, that the man had a 
jihadist motive for his attack. 
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A number of violent incidents in 
2018 used modi operandi promoted 
by terrorists but were ultimately 
judged not to have been carried 
out by terrorists. For example, in 
August a car drove into pedestrians 
and cyclists and then crashed into 
a security barrier just outside the 
Houses of Parliament in London 
(UK). Three people were injured in 
the incident. The case was originally 
regarded as terrorism due to the 
location, methodology and alleged 
targeting of civilians and police 
officers, but later assessed to be 
a criminal act without a terrorist 
motive. The driver was charged with 
attempted murder. 

In 2018, as in previous years, the 
majority of EU Member States did not 
report any jihadist terrorist attacks. 
Nevertheless, these same EU Member 
States were aware of the potential 
threats emanating from the increase 
in numbers of adherents to jihadist 


ideology, the presence of extremist 
individuals with links to jihadist 
terrorist organisations, and the 
potential of returning FTFs from the 
conflict areas in Iraq and Syria. 

Terrorist networks continue to be 
detected in Europe, including in 
prison. In October 2018, 25 inmates 
were identified in 17 different prisons 
all over Spain belonging to a jihadist 
network. The network was composed 
of prisoners with prior records for 
jihadist terrorism-related crimes 
and of inmates convicted of other 
criminal offences, who presumably 
became radicalised in prison. The 
members of the network ranged 
from one individual linked to the 
11 March 2004 attacks in Madrid 
to returned and frustrated foreign 
fighters, including converts. Italy 
reported that radicalisation in prisons 
remains a matter of concern. Inside 
the Italian prisons in 2018, there 
was reportedly a further increase 


in the number of prisoners showing 
support for IS. Threats to prison 
guards, provocations and disrespect 
to female prison staff and non¬ 
observant Muslim prisoners were the 
most common ways to express such 
support. 

IS was under intense pressure and, 
at the time of writing, had lost almost 
all of the territory it once controlled 
in Iraq and Syria. The group's ability 
to direct external attacks against the 
West appears to be greatly reduced 
due to the consequent attrition of 
personnel and reduction in resources. 
However, despite the lack of capacity, 
the IS core maintains the intent to 
conduct such operations and might 
rely on former members, including 
those currently imprisoned, and 
sympathisers based in Europe. 
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Terrorist propaganda 



IS media in 2018 

The physical caliphate was a 
central propaganda tool of IS. 

The organisation's slogan Baqiya 
wa tatamaddad ('remaining and 
expanding') combined with successful 
military advances in previous years 
convinced thousands to emigrate to 
the lands of the caliphate. The military 
defeat of IS in Irag Syria denied 
the group one of its most potent 
propaganda assets. 

IS' current situation has had a 
significant impact on its digital 
capabilities: propaganda produced 
by official IS media outlets has visibly 
declined. The only publication that 
continued to be issued on a regular 
basis was the official Arabic weekly 
newsletter al-Naba' (The News). 

The group's shrinking capabilities on 
the ground have significantly affected 
its strategic planning. This was evident 
in its failure to implement a planned 
remapping of its provinces. In July 
2018, IS attempted to re-brand its 
propaganda to portray Irag and Syria 
as consisting of just two provinces: 
Wilayat al-Sham (Levant province) and 
Wilayat al-lraq (Iraq province), with 


each province consisting of a number 
of regions. Videos began featuring 
these new epithets alongside the 
previous titles. However, this only 
lasted for a couple of weeks before 
the new titles were dropped and 
propaganda reverted to the use of the 
previous labels. Similarly, IS Hawran 
province - established in July 2018 
in southern Syria - produced a very 
limited number of propaganda items 
and ceased that same month. 

There is also a certain amount of 
confusion as to the actual number of 
IS provinces worldwide. One example 
is that of the IS East Asia province 
which released its first propaganda 
item in May 2018. While East Asia 
was recognised as an IS province 
in al-Naba' in late July 2018, it was 
subsequently downgraded to a region 
in subsequent issues, before again 
being referred to as a province in 
August. 

One of the few regions where IS 
appears to be growing in strength 
and capability is in Afghanistan and 
Pakistan, as its Khorasan province is 
becoming an increasingly prominent 
actor in the Afghan conflict. In contrast 
to other IS branches, the Khorasan 


province produced propaganda on a 
regular basis. While it focused heavily 
on local conflict, it also released a 
number of videos in 2018 suggesting 
the region as a new haven for those 
wishing to join IS but who are 'unable 
to emigrate to Iraq and Syria'. One of 
these videos, titled 'The land of God is 
wide' and released in March, purported 
to document IS' authority over 
territories in Jawzjan (Afghanistan). 
The implication is that the utopian idea 
of the caliphate still holds potential 
in Afghanistan. This message was 
underscored in the video's use of 
languages: while most of the narration 
was in Arabic, fighters also delivered 
messages in Dari, Pashto and Uzbek. 

Nevertheless, the various shifts and 
inconsistencies in IS propaganda in 
2018 reflect the overall collapse of 
the claimed caliphate, previously the 
central pillar of its project. However, 
this collapse combined with the 
group's battlefield attrition did not stop 
the group's online sympathisers from 
continuing to proclaim their support 
for the group. 
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Re-mediatisation 

A lack of IS propaganda from the 
battlefield resulted in re-mediatisation 
and was accompanied by a 
mushrooming of pro-IS media outlets 
and supporter-generated productions 

The spin-off media outlets aimed to 
project the image of an IS franchise 

IS leaders issued a total of three 
speeches in 2018: one was delivered 
by the group's caliph Abubakr al- 
Baghdadi on the occasion of the 
celebration of Eid al-Adha on 22 
August 2018 and two by the group's 
official spokesperson Abu al-Hasan 
al-Muhajir. 

The low number of speeches is 
not in itself unusual (neitherthe 
group's elusive leader nor its current 
spokesperson has delivered more 
than two speeches a year since 
2015). Nevertheless, this has meant 
that IS sympathisers have been 
forced to resort to recycling older 
material to produce their supporter¬ 
generated content (SGC). In fact, 
the most notable speeches used for 
SGC purposes in 2018 date backto 
2016 and were delivered by former 
IS spokesperson Abu Muhammad 
al-Adnani. This contrasts heavily with 
al-Qaeda - both core and affiliates 
- who issued topical speeches on a 
regular basis. 

The year 2018 also saw a decrease in 
the number of IS videos featuring high- 
production values and high-definition 
drone footage of the battlefields. 
Official IS videos featured little beyond 
ruined towns and occasional forays 
into enemy territory. However, the 
group's attack on Iranian forces during 
a national military parade in Ahvaz 
(Iran) on 22 September 2018 provided 
IS with the opportunity to attempt 
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IS media outlets and 
supporter-generated 
productions 


The spin-off media outlets 
aimed to project the 
image of an IS franchise 


to debunk the idea that it was losing 
the ability to mount major military 
operations. IS official media and 
sympathetic media outlets latched on 
to the event and drew inspiration for 
their propaganda from it for weeks 
afterwards. 

Another audio-visual production which 
attempted to highlight IS' capabilities 
was the video series entitled ‘Harvest 
of the soldiers'. The series consisted 
of detailed statistics and information 
regarding the types and the results 
of operations conducted by IS over a 
given week. Released in Arabic and 
English by the al-Hayat Media Center, 
the first episode in the series appeared 
in early August 2018 and continued 
to be issued for the remainder of 
the year 21 . While the production 


21 The 25 th episode on 17 January 2019 was the last 
to appear in the series. 


aimed to showcase IS' proficiency, 
the utilisation of the same graphics 
and special effects from one video 
to the next illustrated the dwindling 
capabilities of the organisation. 

Despite the shrinking of its physical 
footprint, the group continued to 
galvanise a significant amount of 
online supporters. A flurry of new 
media outlets burgeoned in the wake 
of IS' loss of territory and there was 
a noted increase in 2018 in SGC 
publications that were not officially 
linked to any terrorist organisation but 
which were obviously sympathetic to 
IS. 

On social media, posters were the 
most recurrent type of SGC visual 
propaganda and covered a wide range 
of topics, including doctrinal texts and 
the familiar apotheosis of martyrdom. 
The most significant group of SGC 
posters called for lone-actor attacks 
and featured Western landmarks 
alongside exhortative guotes by IS 
leaders. The posters were produced 
in an array of languages and featured 
varying levels of refinement. 

SGC experienced an uptick of activity 
over certain periods (e.g. during 
the 2018 FIFA World Cup in Russia; 
Christmas and New Year holidays; 
and the gilets jaunes protests in 
France), making them more visible 
in mainstream media. It is worth 
highlighting that the threats relating 
to the World Cup and the gilets jaunes 
were posted on media platforms 
supportive of the IS rather than in 
official statements or speeches by 
the group. It is therefore difficult to 
ascertain whether they resulted from a 
concerted decision by senior members 
of the group or if they were instead a 
spontaneous effort by propagandists. 
Discussions on Telegram later claimed 




that IS had distanced itself from the 
World Cup threats, which did not 
materialise, highlighting an issue of 
command-and-control within the IS 
media network. 

IS propagandists 
strive to project an 
idea of unity 

Conscious of their disjointed 
appearance, the SGC outlets showed 
an increasing awareness of the need 
to appear united and aimed to project 
the image of an IS franchise. With this 
in mind, they were careful to produce 
propaganda that carried the hallmarks 
of IS and mimic the group's official 
braggadocio. The need to appear as a 
monolithic bloc and less like disparate 
groups also led to joint campaigns on 
Telegram, including #Answer_the_call 
and #Remaining_steadfast, in which 
the various pro-IS outlets produced 
publications under a common 
hashtag. 

Another joint project is the unofficial 
Youth of the Caliphate magazine, of 
which three issues were released 
in 2018. The magazine is managed 
by a consortium of pro-IS media 
outlets (the Ashhad Media Company, 
the Sunni Shield Foundation and 
al-Saqri Corporation for Military 
Sciences) and is headed by the al- 
Abd al-Faqir Foundation. Youth of the 
Caliphate promotes publications from 
other IS-supportive media outlets, 
including Asawirti Media, the Khattab 
Media Foundation, al-Battar Media, 
al-Bushrayat and al-Adiyat Media 
Production Company. The magazine 
even encourages individual readers to 
send in their own SGC contributions 
for publication. 


IS struggles to 
unify its ideological 
position 

The need to appear united is even 
more crucial in the light of a long¬ 
standing ideological dispute - 
between the lesser and more radical 
members of IS - that is currently 
raging online. The debate on the 
concept of takfir (the act of declaring 
other Muslims unbelievers), which had 
come to the fore in official IS media 
and had ostensibly been settled in 
2017 in favour of the less radical 
position 22 , continued in 2018 and 
extended to SGC outlets. The online 
dispute in 2018 pitted the central IS 
Media Department, which appears to 
have returned to its radical stance, 
against two more 'moderate' media 
foundations formerly supportive 
of IS: al-Wafa' and al-Turath al- 
'llmi. Supporters of the two camps 


22 The disagreements date to May 2017 when IS 
issued a controversial memo which set out its 
new stance on takfir. The memo argued that takfir 
is a foundation of the Islamic faith. In practical 
terms, this would mean that even if a Muslim 
committed no sin him or herself, he or she could be 
denounced as a disbeliever for failing to condemn 
other alleged sinners. The memo also included 
an opinion on the issue of 'excuse of ignorance', 
roughly equivalent to the legal principle ignorantia 
juris non excusat. While the long-held IS position 
had been that ignorance of a religious obligation 
- such as refraining from declaring Muslims who 
take part in elections unbelievers - was held to be 
excusable, the new memo rejected ignorance as 
an excuse. As a result, not only did the memo cast 
doubt on whether Sunni Muslims worldwide could 
be considered true Muslims, but some of IS' own 
leaders and members could be declared unbelievers 
under the terms delineated in the ruling. In 
addition, the debate also included discussion of 
other religious concepts that supported IS ideology, 
including al-wala' wal-bara' (loyalty to Muslims and 
disavowal of polytheists) and nawaqid al-lslam or 
nullifiers of Islam (sets of conditions with which all 
Muslims must comply, e.g. not to ally with infidels 
against Muslims). The ruling was quick to spark 
controversy among IS followers and deepened 
the already existing debate on the issue. Some of 
IS' senior ideologues objected to this definition of 
takfir. See also Europol, TE-SAT 2018, p. 33. 


exchanged insults and refutations 
online, with the former arguing that 
the IS Media Department is too radical 
in its approach to issues such as 
takfir, and the latter accusing al-Wafa' 
and al-Turath al-’llmi of being spies 
and calling into question their support 
for the caliphate. 

The overall result was an energetic 
media campaign increasingly 
divorced from realities on the ground. 
The loss of a coherent narrative in the 
light of the organisation's territorial 
losses, its weakened branding and 
waning credibility underscored a 
general state of confusion in the 
ranks of IS and a lack of cogency in its 
arguments. 

An al-Qaeda 
resurgence? 

IS' loss of significant territory in 
Iraq and Syria stands in contrast to 
al-Qaeda's lack of major change over 
the same period. While IS dominated 
headlines, al-Qaeda has focused on 
consolidating its influence in both 
existing and new theatres. As a result, 
it has succeeded in subsuming a 
number of franchises in a global 
movement that runs from North-West 
Africa to South Asia. Furthermore, 
despite boasting a less diversified 
online infrastructure than its rival, 
al-Qaeda's propaganda output has 
remained constant. 

Al-Qaeda sets itself apart from IS in 
its discourse and presents itself as 
a level-headed pragmatic group that 
seeks redress for the people. The 
organisation is currently focusing 
more on local concerns as opposed to 
global jihad and couches its speeches 
in the context of political realism. Al- 
Qaeda has also successfully gained 
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remained constant 


Al-Qaeda sets itself apart 
from IS in its discourse 
and presents itself as a 
level-headed pragmatic 
group with legitimate 
political and socio¬ 
economic grievances 


leverage by giving more space to local 
affiliates and recognising the added 
value of coalescing power from the 
grassroots level. 

Al-Qaeda also takes a more nuanced 
approach in its diatribes against 
the West, although - like IS - it also 
conflates the terms 'crusaders', 
'Christians' and 'Westerners'. 

However, al-Qaeda focuses more 
substantially on what it describes as 
Western governments' iniquitous and 
predatory policies and less on the 
degeneracy and anathematisation of 
Western culture as a whole. 


Al-Qaeda affiliates 
are gaining strength 
in the Sahel 

Ayman al-Zawahiri, the nominal head 
of al-Qaeda, mentioned West Africa 
several times in his most recent 
speeches. He even devoted two 
videos over the course of one week 
in March 2018 to the topic of jihad 
in Africa and took the opportunity to 
call for an uprising against 'Western 
occupying powers in the region'. 

Al-Qaeda's affiliates in West Africa, 
most notably al-Qaeda in the Islamic 
Maghreb (AQIM) and Jama'at Nusrat 
al-lslam wal-Muslimin (JNIM, 'group 
in support of Islam and Muslims'), 
also issued a wave of threats against 
Western interests in the region. Two 
of the most common leitmotifs in 
AQIM and JNIM's speeches are the 
redistribution of resources and the 
need to resist Western hegemony. 
Both groups railed against the 
'colonially installed governments' and 
'surrogate regimes' who allowed their 
patrons largely unfettered access 
to local resources and served the 
interests of foreign powers ahead of 
their own citizens. 

Al-Qaeda also stressed the 
paramountcy of the region's Islamic 
identity and its own role as a 
revolutionary exemplar for the umma 
(global Muslim community). It pointed 
to an alleged Western conspiracy 
against Islam and accused the West 
of harbouring plots and designs to 
subordinate, humiliate and undermine 
Islamic institutions and culture. 

The West in general - and France 
in particular - was presented as an 
occupying force corrupting Islam. 

While AQIM and JNIM presented 
similar narratives in their audio-visual 


productions and their message 
projected an overriding sense of unity 
and complementarity - indeed they 
appeared to share media resources - 
JNIM concentrated on the belligerent 
content, while AQIM had greater 
responsibility for the ideological 
content. An important point on the 
belligerent narrative is that al-Qaeda 
visibly attempted to differentiate itself 
from IS by not including scenes of 
beheadings in its propaganda. 

In stark contrast to IS, AQIM and JNIM 
attempted to reach out to Western 
civilians to explain their position. 
Propaganda produced by the two 
al-Qaeda affiliates stressed that their 
targets for attack were the Western 
military contingents stationed in the 
region and not civilians. A case in 
point is the discourse put forward 
by a French female hostage held by 
JNIM since late 2016, who appeared 
in three videos produced by their 
official mouthpiece al-Zallaqa Media 
in 2018. She spoke of the respectful 
treatment she had received from 
her captors and described them as 
'trustworthy'. In contrast, she accused 
the French government of obstructing 
her release. While hostage taking 
was a recurring theme in JNIM's 
productions, the group stressed that 
the hostages were taken as 'just 
retribution', the suggestion being that 
Western citizens would no longer be 
targeted, should these foreign powers 
stop their interventions in the region. 

Similarly, in a speech released 
in late December 2018, AQIM's 
leader exploited the French gilets 
jaunes protests to denounce what 
he described as France's neo¬ 
colonialism and to appeal to the wider 
French public. He evoked a growing 
dichotomy between a 'corrupt 
French elite' and the majority of the 
French population and drew parallels 
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between the plight of the protesters 
and that of the 'victims of French 
colonialism'. He described the costly 
military involvement of France in Mali, 
Libya, Central Africa and other African 
countries as the root cause of current 
socio-economic issues that prompted 
the gilets jaunes movement. 

Al-Qaeda offshoots 
and branches in 
Syria continue to 
cause confusion 

Hay'at Tahrir al-Sham (HTS, 'Levant 
Liberation Committee'), whose 
main component Jabhat Fath al- 
Sham publically split from al-Qaeda 
in 2016 23 , became the dominant 
jihadist force in Syria in 2018. HTS 
distanced itself from the international 
terrorist group brand in a statement 
in June 2018 and condemned its 
terror designation by the US State 
Department. The statement also 
stressed that HTS posed no threat to 
countries outside Syria. 

In 2018, HTS focused on proving its 
state-building capabilities in a bid to 
position itself as a negotiating partner 
on the Syrian scene. In particular, it 
utilised its two media outlets ( Amjad 
Media and the Iba' News Agency 
which, while it has not been officially 
linked to HTS, clearly acted as its 
mouthpiece) to document its ability 
to exert effective administrative 
control over the north-western Idlib 
governorate, one of the last armed 
opposition strongholds in Syria. 

HTS continued to push back against 
all attempts to designate the 
organisation as a terrorist threat and, 
with this in mind, attempted to market 


23 For developments since 2016, see Europol, TE-SAT 
2018, p. 37. 


Iba'News as an unbiased and credible 
media outlet. Indeed, iba' News, first 
issued in June 2018, resembles a 
mainstream newspaper in content 
and style and covers foreign policy 
issues and Syrian social issues. In 
contrast to IS' weekly al-Naba', Iba' 
News contains no religious doctrinal 
texts. One clue to its ideological 
leanings is the derogatory designation 
of IS as khawarij 211 . Its desire to 
present itself as a mainstream media 
outlet led Iba' News to denounce the 
Google Play Store in September 2018 
fortaking down its mobile phone 
application. 

Another relevant armed group 
operating in Idlib is Tanzim Hurras 
al-Din (THD, 'guardians of the religion 
organisation'), a splinter group 
from HTS and widely believed to 
be al-Qaeda's new affiliate in Syria, 
although it has not yet been officially 
accepted by the al-Qaeda senior 
leadership. THD subsumed a number 
of smaller jihadist factions and made 
new military alliances with others. 
THD also focused on developing its 
own brand. In addition to using Sham 
al-Ribat Media as its official outlet, 
the group launched the first issue 
of al-Falah magazine in late October 
2018. Al-Falah offers political analysis 
interspersed with religious advice, 
political implementation of Islamic 
law and technical guidance with 
regard to anonymity and security. The 
magazine also aims to stress that al- 
Qaeda remains a robust organisation. 


24 The Khawarij were a group that rebelled against 
the fourth caliph, Ali ibn Abi Talib during the first 
century of Islam. The movement is known in Sunni 
and Shi'i circles for their extreme dogma (for 
example, with regard to excommunicating other 
Muslims). 


Common aims and 
ambitions 

While jihadist discourse targets 
Westerners in general, a number 
of states are singled out: France, 
the UK and the USA. These three 
countries in particular are vilified for 
their perceived negative role in the 
Israeli-Palestinian conflict and are 
generally accused of harbouring neo¬ 
imperialist ambitions in the Middle 
East and Africa. These accusations 
are levelled by supporters of both IS 
and al-Qaeda. 

France, in particular, was the focus for 
a plethora of jihadist organisations 
in 2018. Media outlets supportive of 
IS and al-Qaeda targeted France (and 
French interests) both for attacks 
and what appears to be recruitment 
purposes. Al-Qaeda's senior 
leadership, as well as AQIM and JNIM, 
accused France of plundering Muslim 
countries' resources and of refusing 
to let go of its former colonies. JNIM 
also claimed France was seeking to 
create a turf war in the region. HTS 
also accused France of duplicitously 
claiming to defend human rights in 
Syria while supporting the Syrian 
regime. 

In terms of French-language 
propaganda, al-Kifah continued 
to provide French translations of 
al-Qaeda productions, while the 
Centre Mediatique an-Nur and the 
online magazine Mediaction - first 
released in February 2018 - catered 
to IS francophone supporters. The 
official HTS outlet Amjad provided 
French subtitles to a number of its 
videos in what appears to be a bid 
to rally French-speaking supporters. 
However, the Amjad videos bore no 
direct link to France and neither was 
France designated by HTS as a target 
for attacks. 
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There were also attempts to revive 
English-language publications in 
support of IS. In February 2018, for 
example, Ahlut-Tawhid launched a 
new magazine titled From Dabiq to 
Rome. Although it claimed to have 
no organisational ties to any group 
and was generally restrained in tone 
(with the first issue dedicated to the 
discussion of religious concepts such 
as apostasy, disbelief and respect 
of shari'a regulations), the magazine 
contains a News Recap section that 
provides a collection of updates on IS 
developments on the field. However, 
overall the newsletter was amateurish 
in comparison to IS' former English 
language flagship magazines Dabiq 
and Rumiyah. Similarly, the Halummu 
News Agency, which has in the past 
provided English translations of IS 
propaganda items, resurfaced on 
Telegram on 17 December 2018 as 
well as on alternative platforms. 

IS and al-Qaeda 
continued to 
experiment with 
online platforms 

In addition to the territorial losses 
inflicted on IS, 2018 took its toil 
on the group's digital presence. 

In response to intensified and 
coordinated take-downs in 2018 by 
law enforcement and social media 
platforms - including Telegram - IS 
supporters doubled their efforts to 
remain relevant online and continued 
to seek out new online vectors for 
their propaganda. Despite frequent 
deletions of content, the group and its 
supporters persisted in publishing on 
a wide array of media and file-sharing 
sites. 


In this context, pro-IS Telegram 
channels reiterated the importance 
of ‘media jihad' and urged supporters 
to join 'invasion and publishing' 
brigades. This was followed by a 
noticeable increase in pro-IS media 
outlets specialising in providing 
instructions on cyber and operational 
security. The most prominent of 
these were al-Saqri Corporation 
for Military Sciences, Horizons 
Electronic Foundation and the United 
Cyber Caliphate. Given the relative 
scarcity of official IS instructional 
guides in English, these unofficial but 
increasingly specialised media outlets 
were attempting to fill a perceived 
gap. They also provided advice on 
how to avoid account deletion, with 
suggestions including using channel 
names that cannot be associated with 
IS. Channel administrators were also 
increasingly creating several versions 
of the same channel, allowing them 
to swiftly rebound from account 
suspensions. Similarly, IS-affiliated 
websites that act as repositories 
for the organisation's propaganda 
responded to recurrent suspensions 
by creating new domain names and 
re-emerging at new locations from 
backup copies. 

Furthermore, pro-IS and pro-al-Qaeda 
Telegram channels advertised the 
use of alternative platforms relying 
on blockchain or peer-to-peer 
technology, e.g. Rocket.Chat and 
ZeroNet. However, jihadist activities 
on these platforms failed to gain 
traction in 2018. As a result, Telegram 
remained the platform of choice for 
both al-Qaeda and IS sympathisers. 
This attempted shift indicates jihadist 
groups' awareness of and willingness 
to exploit new technologies. 
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Travel for 
purposes 

© 

The number of European 
foreign terrorist fighters 
travelling or attempting to 
travel to the conflict zone 
continued to decline and 
was very low 


Foreign terrorist fighters 
were reported to have 
travelled to alternative 
theatres of conflict but in 
low numbers 


terrorist 


Since the beginning of the conflict, 
approximately 5 000 individuals from 
the EU have travelled to join fighting 
groups in Iraq and Syria. Belgium, 
France, Germany and the UK are the 
major EU source countries. At the end 
of 2018, the number of EU citizens 
still in the region appeared to amount 
to less than 2000 - with France 25 and 
the UK having the highest numbers, 
around 710 and 345, respectively. 

More than 1 000 individuals are 
believed to be dead, and although 
accurate figures were not available 
at the time of writing, a large number 
appeared to have been taken prisoner 
or detained in Iraq and Syria. Some 
were reportedly being held in Kurdish 
camps (including women and minors) 
or by the Iraqi authorities; others 
were detained in Turkey. According to 
Spain, some former foreign terrorist 
fighters (FTFs) were able to settle in 
Turkey. 

Continuing decline 
in travelling FTFs 

Compared to previous years, the 
number of EU FTFs travelling to the 
Iraq and Syria conflict zone in 2018 
was very low. There were also some 
attempted journeys - for example, 
one individual was prevented from 
leaving Austria twice; and Spain 
reported two individuals that 
succeeded in travelling. 

The European jihadist movement is 
currently in a process of reorientation. 
While in previous years the focus 
had been on travelling to and 


25 The breakdown of this figure still in situ from 
France includes 355 men, 301 women and 55 minors 
of more than 13 years old. 


fighting in jihadist conflict zones in 
Iraq and Syria, it has since shifted 
towards activities in the EU related 
to spreading the jihadist message - 
both online and offline. The jihadist 
movement in the Netherlands, for 
example, is now many times larger 
than it was before the war in Syria. 

In this context, it is notable that the 
Netherlands foiled an extensive 
terrorism plot in the latter part of 
2018. The suspects - three of whom 
had been arrested in previous years 
for trying to travel abroad to fight - 
were seeking to carry out twin vehicle- 
borne improvised explosive device 
(VBIED, or car bomb) and gun attacks. 

Travel of women 
and minors 

The absolute number of women that 
have travelled/remain in the conflict 
zones is relatively low for most EU 
Member States. France appears to 
have a high number: 33 % of 1324 
individuals who travelled from France 
since 2012 were women. 

Already in 2016, EU Member States 
identified women as posing not 
only a threat concerning facilitation, 
recruitment, financing and 
propaganda production but also 
as potential attackers and fighters. 
Several plots involving women were 
foiled by police in Europe in recent 
years. During the latter part of 2017, 

IS promoted a more active role for 
women in combat zones. 

The Netherlands also observed that 
by the end of 2018 at least 145 minors 
with a connection to the Netherlands 
were living in the conflict zone in Iraq 
and Syria. More than half of them are 
below the age of four and were mostly 
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born there. In addition, there are at 
least 30 minors with a connection to 
the Netherlands living somewhere 
in the region outside the conflict 
zone. As previously stated France 
has at least 55 minors over the age 
of 13 in Iraq and Syria. Switzerland 
also mentioned the presence of 
approximately 20 children (younger 
than 12) among the jihadist travellers 
in conflict zones that have links to 
Switzerland. 

While they are essentially victims, 
there are concerns among EU Member 
States that minors who have been 
exposed to indoctrination and training 
in former IS territories, may pose a 
potential future threat. 

Travel to other 
destinations 

Jihadists who were unable to reach 
IS territory in Iraq and Syria may 
have been directed to IS' branch or 
affiliate groups instead. As illustrated 
above, there also remains a high risk 
that aspirant travellers, unable to 
join IS become frustrated and turn 
their focus to conducting attacks in 
their home countries. Albeit current 
numbers appear to be relatively small, 
FTFs have been reported to have 


travelled to alternative theatres of 
conflict. 

Austria assessed that, with IS' decline 
in Iraq and Syria, North Caucasians 

- who constituted 40 % of their FTFs 

- increasingly returned to their former 
focus of fighting against Russia. 
Interestingly, Austria also stated that 
at least two North Caucasian fighters 
travelled to the conflict area in Eastern 
Ukraine - where they were fighting on 
the Ukrainian side. 

Two countries - Germany and Spain - 
reported on one subject each that had 
travelled to the Philippines, located 
in a region where IS has ambitions to 
develop. Of specific note, in July 2018, 
a German-Moroccan national blew 
himself up at a checkpoint in Lamitan 
on the island of Basilan, killing 15 
people; IS claimed responsibility for 
the attack. The suicide bomber is 
believed to have already left for the 
Philippines in October 2017 where 
he reportedly joined an 'IS-friendly' 
faction of the former Abu Sayyaf. 

This was the first suicide attack in the 
Philippines carried out by a German 
national. Also in the Philippines, 
an FTF from Spain was arrested in 
January 2018 in Maluso, Basilan. 

At the time of his arrest, he was 
accompanied by a known terrorist 


from the region and police found 
several weapons and components 
to build explosives among his 
belongings. This person left Spain in 
the first trimester of 2017, presumably 
with the aim of joining IS in Iraq 
and Syria, but was unsuccessful - 
prompting his travel to the Philippines 
in October. 

France reported that 39 individuals 
were localised in a 'third country' (at 
present unknown) after a stay in the 
Iraq/Syria zone. Moreover, Ireland, 
Italy and the UK observed that a 
number of FTFs travelled to Libya/ 
North Africa. In Italy's case, the 
suspects travelled there for training 
with IS and then returned to Italy. 

Conversely, Sweden reported that 
there was no information indicating 
that Swedish members of IS or 
other jihadist organisations have 
relocated from Syria to other conflict 
zones. Their returnees have not been 
connected to a confirmed plot and 
most have returned to their former 
cities, neighbourhoods and groups of 
friends, and have taken up activities 
they were involved in before travelling. 
Sweden pointed out that almost all 
their returnees travelled back using 
their own travel documents. 
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Returnees and 
routes 

Since the beginning of the Syrian 
conflict, countries such as Austria, 
Belgium, Finland, France and Italy 26 
have seen a return rate of between 
approximately 20 % and 30 %. The 
Netherlands and Spain have noted 
roughly 18 % have returned; and 
Germany and the UK appear to have 
experienced the highest proportions 
of their FTFs returning - around 33 % 
and 45 % respectively. 

Those that have returned garner 
kudos with like-minded individuals. 
Their training and experience - such 
as handling weapons and explosives 
- makes them exceptionally 
dangerous. Furthermore, EU Member 
States' ongoing concern is that 
these individuals can perpetuate 
and strengthen their networks both 
nationally and internationally. 

Turkey continued to be the main hub 
for FTF travel. Flowever, its increased 
law enforcement activity also likely 
contributed to stemming the flow of 
travellers. Confirmed overall figures 
of EU FTFs held in Turkey, Iraq and 
Syria are not currently available. For 
a number of countries, the collection 
and verification of information on their 
citizens' fate remains a challenge. 

Routes to and from Iraq and Syria 
do not appear to have markedly 
changed. The Western Balkans 
and EU countries such as Bulgaria, 
Flungary and Romania were again 
used as transit countries. Romania, 
for example, reported that the number 
of cases continued its downward 
direction since the previous year (in 
keeping with the European trend). 

Also of interest, in 2018 Moldova 


26 Italy stated that they have 28 returnees to 
Europe, with only 12 returning to Italy. 


detained and expelled five FTFs who 
were citizens of Russia, primarily from 
the North Caucasian Republics and 
Uzbekistan. 

Women and minors are amongst 
those that have returned. Bosnia and 
Flerzegovina, for example, reported 
three adults returned to their territory 
from Syria (two women with three 
young male children and one man). In 
another example, Belgium reported 
that in December 2018, the process 
to repatriate six minors and their two 
widowed mothers in a camp in Syria 
was pending. 

The pressure of migrant flows 
towards the EU stabilised in 2018, 
but the continuation of the use of 
smuggling routes, mainly through 
the Western Mediterranean Sea and 
Western Balkan countries, remained 
a matter of concern from a counter¬ 
terrorism perspective. As previously 
reported, terrorist use of the migrant 
flow has been observed, but it is not 
deemed systematic. However, future 
clandestine use of this modi operandi 
by FTFs cannot be ruled out. 

Specifically, Italy reported that in 
2018 jihadists linked to the Iraq and 
Syria IS branch or individuals from 
'radical Libyan environments' were 
able to reach their shores, infiltrating 
the irregular immigration flows. An 
example illustrating this concerned 
arrests carried out in April (in Naples) 
and June 2018 (in Bari) of two asylum 
seekers from The Gambia who had 
previously illegally entered via Sicily. 
They had pledged allegiance to IS 
and had been sent by the group after 
being trained in Libya to commit 
an attack against a crowd using a 
vehicle. 


© 

In 2018, the number of 
FTFs returning from the 
Iraq and Syria conflict 
zone remained very low 


Combat training, 
experience and 
international contacts of 
returnees remain a matter 
of concern 


Terrorist use of the 
migrant flow has been 
observed, but it is not 
deemed systematic 
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Terrorist situation 
outside the EU* Iff 

*This section is largely based on open sources, 
complemented by Europol in-house knowledge. 


Several EU Member 
States expressed 
concern about 
developments in conflict 
zones outside the EU, 
including Afghanistan, 
Irag, Libya and Syria and 
having a negative impact 
on the security situation 
inside the EU. Military 
setbacks of terrorist 
organisations in these 
regions might motivate 
their members to take 
retaliatory action in 
Europe. 



Americas and 
Australia 

Lone actor attacks claimed by IS took 
place in 2018 in Canada and Australia. 
In Canada, a 29-year-old Canadian of 
Pakistani origin armed with a firearm 
killed an 18-year-old woman and 
a 10-year-old girl on a busy street 
in Toronto on 22 July 2018. The 
assailant, who according to his family 
had suffered from mental health 
problems since his childhood, was 
killed by police. Three days later, IS 
claimed responsibility for the attack 
through its Amaq News outlet. 

In Australia, a Somali citizen drove a 
car into shop fronts in Melbourne on 9 
November 2018, exited and attacked 
passers-by with a knife, killing one 
person. He was killed by police. The 
attack was claimed by IS through an 
Amaq News statement, but no links 


with the organisation had come to 
light at the time of writing. The IS 
newsletter al-Naba', referring to the 
Melbourne attack, acknowledged that 
most lone actors had not actually 
met IS leaders or members, received 
ideological or military training or 
financial support. The attackers were 
solely inspired by IS acts, propaganda 
and ideology. 

In 2018, despite IS calls for people 
in the USA to take advantage of the 
country's firearms laws to acquire 
weapons and perpetrate attacks, IS 
did not claim any violent incidents in 
the USA as having been perpetrated 
by its members. 

In Bogota (Colombia), in March 2018 
a Cuban citizen, who had entered 
Colombia illegally, was arrested on 
suspicion of planning attacks on 
American and Cuban embassy staff 
and high-ranking Fuerzas Armadas 
Revolcionarias Colombianas (FARC, 
Colombian Revolutionary Armed 
Forces) members. The suspect, 
who denied being a Muslim, was 
reportedly in contact with Libyan 
extremists via Telegram who provided 
advice on IED manufacturing and 
target selection and appealed to him 
to dedicate the attack to IS. 
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Western Balkans 

Western Balkans countries reported 
that radicalised communities, 
some comprising returnees from 
the conflict zones in Iraq and Syria 
existed on their territories and 
were engaged in recruitment and 
propaganda activities, but terrorist 
activities were rarely observed. 

In Montenegro, the jihadist 
community mostly includes returnees 
from Syria. Its members form a 
closely knit community and carry out 
propaganda activities with the aim to 
recruit new supporters. In February 
2018, an explosive device was thrown 
at the US embassy in Podgorica, but 
its explosion caused no casualties. 
The attacker committed suicide by 
exploding a second device on himself. 


Russia, Caucasus 
and Central Asia 

Russia reported that in 2018, 37 
terrorist cells were dismantled on 
its territory and 28 acts of terrorism 
prevented at different stages of 
preparation or execution. During 
the reporting period, 65 terrorists 
including 10 group leaders were 
killed and 166 recruiters identified. 
More than 60 Russian and foreign 
citizens were prevented from 
entering armed conflict zones 
to participate in the activities of 
international terrorist organisations. 
According to Russia, several cases 
of the attempted use of unmanned 
aerial vehicles (UAVs, i. e. drones) 
carrying explosive devices were 
noted. 



In Chechnya (Russia), three 
coordinated attacks targeting 
security forces - all of whom 
survived - were carried out on 20 
August 2018, a day ahead of Eid 


Turkey 

IS did not carry out any attacks in 
Turkey in 2018, despite repeated 
threats and calls for its supporters 
to do so. In addition to the threat 
of terrorist attacks, Turkey also 
reported that members of the 
Syrian opposition living in Turkey, in 
particular journalists, were targets of 
assassination. 


al-Adha, by five young males aged 
between 11 and 17. The incidents 
included a knife attack on a police 
station and a car ramming targeting a 
police checkpoint, in which four of the 
attackers were killed. The third attack 
was an attempted suicide bombing, 
which the perpetrator survived. Amaq 
News released a video featuring the 
attackers pledging allegiance to IS. 

Austria reported a restructuring 
among sympathisers and activists 
of the al-Qaeda-aligned Caucasus 
Emirate and IS' Caucasus province. 
This was connected to the death of 
a leading jihadist in November 2017 
in Tbilisi (Georgia). He had been 
granted political asylum in Austria 
and had been part of a Europe-wide 
network of Chechen expatriates 
for several years. The impact of 
this restructuring had not become 
apparent at the time of writing. 

On 29 July 2018, a terrorist attack in 
Tajikistan targeted a group of tourists 
cycling in the Danghara District. The 
attackers drove a car into the group 
and then stabbed the cyclists, killing 
two American citizens, one Dutch and 
one Swiss citizen; and wounding a 
Dutch and a Swiss citizen. The attack 
was claimed by IS through an Amaq 
News and a formal IS statement. In 
addition, a video released by Amaq 
News two days after the attack 
showed the five attackers pledging 
allegiance to IS. 
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Iraq and Syria 

In Syria, IS continued losing territory 
in 2018 and, by the end of the year, 
was reduced to small pockets of land 
along the lower Euphrates valley near 
the Iraqi border. It was estimated that 
several thousand IS fighters, including 
European FTFs, were concentrated in 
this area. 

Large numbers of IS members were 
taken prisoners in 2018, including 
many women and minors. Some 
detainees were suspected of 
committing atrocities, such as two 
UK nationals alleged to have been 
members of a notorious IS execution 
cell. They were reportedly captured 
by Syrian-Kurdish fighters close to the 
Iraqi border in late January 2018. The 
cell of four individuals is said to have 
been responsible for killing at least 27 
Western hostages. 

Also during 2018, IS continued 
their activities in areas outside 
their territorial control, perpetrating 
attacks sometimes after extensive 
surveillance activities. For example, on 
25 July, IS claimed responsibility for 
a suicide attack followed by firearm 
assaults that killed over 200 people 
in al-Suwayda' in southern Syria, 
which at the time was already under 
Syrian regime control. IS attacks also 
targeted members of rival jihadist 
groups, such as Hay'at Tahrir al-Sham 
(FITS, 'Levant Liberation Committee') 
leaders in Idlib in July 2018. On the 
other hand, armed opposition groups 
in northern Syria reported that they 
detained IS members or dismantled 
IS cells, who had been involved in 
planting lEDs and kidnapping for 
ransom in different areas around Idlib. 

In mid-July 2018, IS radically 
simplified its system of territorial 
entities, regrouping all Syrian 
provinces into a 'Levant province' 
(wilayat al-Sham) and all Iraqi 
provinces into an 'Iraq province' 
(wilayat al-iraq). The apparent aim was 
to mitigate the reputational damage of 
being evicted from areas that IS had 


previously declared its provinces. 

Except for the Kurdish-held north¬ 
eastern part of its territory, Syria 
witnessed the rapid expansion 
of Syrian regime control in 2018, 
eventually limiting the territory held by 
the armed opposition to the region of 
Idlib and small portions of Aleppo and 
Flama governorates. Despite being 
declared de-escalation zones in the 
Astana talks in July 2017, the Syrian 
regime and its allied militias advanced 
on several rebel-held pockets, starting 
with eastern Ghuta near Damascus in 
March. Jaysh al-lslam (Army of Islam), 
which had controlled the area, was 
allowed to evacuate to the Idlib region. 
Similarly, in June 2018, an offensive 
was launched against opposition-held 
areas in southern Syria. The remaining 
opposition forces, which had already 
been fighting IS-linked factions in 
the area, surrendered to the regime 
by mid-July 2018. As a result, Syrian 
regime forces came in direct contact 
with IS-linked factions in the region, 
including Jaysh Khalid bln al-Walid 
('Khalid bin al-Walid army'). These 
factions reacted by officialising their 
link to IS. On 10 July, a suicide attack 
in the area was claimed under the 
name of IS Flawran province, which 
ceased activities in late July 2018. 

In September 2018, the Syrian regime 
seemed to prepare an offensive 
against rebel-held territories in 
northern Syria around Idlib. This 
was prevented by a 17 September 
agreement concluded in Sochi 
between Russia, Iran and Turkey, 
which stipulated the creation of a 
demilitarised zone along the frontline 
around Idlib, from which 'radical' 
rebels, including Jabhat al-Nusra, 
would be required to withdraw by mid- 
October 2018. The withdrawal would 
be monitored by joint Russian-Turkish 
forces. 

Turkey consolidated its influence 
in northern Syria in 2018. The 
neighbouring country launched 
Operation Olive Branch in early 2018, 
during which Turkish troops supported 
by Syrian Arab armed opposition 



groups took control of the region 
of Afrin from Yeklneyen Parastina 
Gel (YPG, Peopled Protection Units) 
militias. In this area, the Arab armed 
opposition groups were organised, 
with Turkish support, to form an entity 
referred to as the Syrian National 
Army (al-Jaysh al-Watanl al-Suri ), 
whose stated aim has been to free 
Syria from the Syrian regime, IS and 
the YPG/PKK. The Syrian National 
Army is nominally linked to the Syrian 
Interim Government, which is based in 
Turkey. 

Turkey tried to replicate this approach 
in the rest of the opposition- 
held territory in northern Syria by 
supporting the unification of the 
remnants of the Free Syrian Army 
underthe umbrella of a National 
Liberation Front ( al-Jabha al- 
Wataniyya lil-Tahrir) in late May 
2018. The National Liberation Front 
welcomed the Sochi agreement of 
17 September 2018 but stated that 
they would not hand over weapons or 
territory. 

Turkish efforts at uniting the 
military factions of the Syrian armed 
opposition underthe leadership 
of the Syrian Interim Government 
coincided with the attempt to 
legitimise territorial rule by FITS 
through the creation of a Syrian 
Salvation Government ( Hukumat 
al-lnqadh), which was formed in 
Idlib region by a 'General Syrian 
Congress establishment board' in 
early November 2017. Nominally 
independent, its activities are strongly 
characterised by the influence of 
FITS, for example in the application of 
Islamic punishments. 
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In mid-February, two opponents 
of HTS, the Ahrar al-Sham Islamic 
Movement and the Nural-DIn al-Zinki 
Movement merged under the new 
name Jabhat Tahrlr Suriya ('Syrian 
liberation front’). At the time of the 
creation of HTS, the Ahrar al-Sham 
Islamic Movement had merged with 
many groups opposing the former's 
creation. The Nural-Din al-Zinki 
Movement had initially joined HTS but 
seceded from it in late July 2017 in 
protest of HTS' hostility towards Ahrar 
al-Sham. The creation of Jabhat Tahrir 
Suriya was followed by an immediate 
attack on its forces by HTS. Several 
mediation attempts between the 
groups could not prevent violence 
from breaking out at several points 
in 2018. In early August 2018, Jabhat 
Tahrir Suriya and other factions joined 
al-Jabhat al-Wataniyya lil-Tahrir. 

The conflict between HTS and 
Jabhat Tahrir Suriya also concerns 
the status of foreign fighters in the 
enclave. The Turkistan Islamic Party, 
for example, stated repeatedly that 
it remained neutral in the conflict. 

In mid-November, HTS publicly 
denied rumours about the existence 
of divisions between nationalities 
among its members. 


Egypt 

In Egypt, President Abdel Fattah 
al-Sisi, who ousted President 
Muhammad Mursi in 2013 and was 
elected president for the first time 
in 2014, was confirmed in office in 
presidential elections from 26 to 28 
March 2018. 

In response to the attack on a Sufi 
mosgue in late November 2017, 
President al-Sisi declared that 
stability would be restored in the Sinai 
Peninsula within a period of three 
months. In early February 2018, the 
Egyptian government announced a 
massive military campaign against 
terrorists on the Sinai. 


Despite publicly cutting ties with the 
al-Qaeda leadership, HTS continued to 
harbour al-Qaeda veterans in territory 
it controls in northwestern Syria. 

In addition, 2018 witnessed a re¬ 
structuring of jihadist currents beyond 
HTS in Syria. In early February 2018, 
Jabhat Ansar al-Din, a non-aligned 
jihadist group and one of the founding 
members of HTS, re-established 
itself as an independent group. In 
late February 2018, several smaller 
groups of former HTS members loyal 
to the al-Qaeda leadership created 
a new entity, Tanzim Hurras al-Din 
(THD, 'guardians of the religion 
organisation'). The group has been 
dominated by prominent former 
members of Jahbat al-Nusra and al- 
Qaeda veterans, who were opposed 
to the severance of ties with al- 
Qaeda in 2016, when Jabhat al-Nusra 
renamed into Jabhat Fath al-Sham 
or left the organisation after Jabhat 
Fath al-Sham merged in HTS in early 
2017. In 2018, THD focused on the 
local conflict, based on the media 
statements the group has released 
detailing military action against 
the regime. It is likely however that 
THD will hold stronger aspirations 
to conduct external attacks than 



Also in February 2018, IS published 
a video in which it warned Egyptians 
against voting and urged Islamists to 
attack security forces and leaders. 

Two days before the presidential 
elections, on 24 March, a bomb 
planted under a car exploded 
when the vehicle of the local 


other al-Qaeda elements in Syria, as 
it is assessed that the leadership is 
likely to be loyal to wider al-Qaeda 
objectives. 

In addition to al-Qaeda loyalists, 

THD is likely also to contain former 
IS members. Reportedly, significant 
numbers of IS fighters arrived in Idlib 
province in 2018, joining a variety 
of jihadist groups, such as Ansar al- 
Tawhid ('supporters of monotheism'), 
which emerged in March 2018 and 
entered short-lived cooperation with 
THD in April underthe title Hilf Nusrat 
al-lslam ('Islam support alliance'). 

In mid-October, several jihadist 
groups opposed to HTS' position 
on the Sochi agreement, including 
Jabhat Ansar al-lslam, THD, Jama'at 
Ansar al-lslam and, probably, Ansar 
al-Tawhld, established a joint platform, 
the Wa-harrid al-Mu'minin Operations 
Room ('And encourage the believers' 
operations room). This formation 
tried to maintain a low profile and stay 
neutral in the conflict between the Nur 
al-Din al-Zinki Movement and HTS. 


police chief passed in Alexandria, 
killing two policemen. The attack 
was not claimed; Egyptian state 
media attributed it to the Muslim 
Brotherhood. 

IS Sinai province warned the Egyptian 
army to stay away from Sinai and 
threatened attacks in Cairo in a video 
published on 23 March 2018. 

On 2 November, seven people 
were killed in a firearms attack on 
a bus carrying pilgrims to a Coptic 
monastery in al-Minya province 
approx. 250 km south of Cairo. IS 
claimed responsibility for the attack 
via its Amaq News outlet and a 
statement from IS Egypt province. 
Commenting on the attack, al-Naba' 
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advised Muslims to stay away from 
churches, army and police facilities, 
foreign embassies and places 
frequented by 'Crusader' nationals. A 
similar attack had taken place in the 
region in May 2017 27 . 

Three Vietnamese and one Egyptian 
were killed in a roadside bomb attack 
on a tourist bus near the pyramids of 
Giza on 28 December 2018. According 
to the Egyptian interior ministry, the 
following day, 40 suspected terrorists 
were killed in coordinated raids on 
three locations in Giza and northern 
Sinai. They were suspected of 
planning a series of attacks on public 
institutions, touristic sites, security 
forces and churches. 


27 Another suicide attack on a church north of 
Cairo was thwarted on 11 August 2018, when the 
perpetrator reportedly was intercepted on his way 
to the planned attack location. In 2019, a bomb 
hidden in a bag in front of a church in the Nasr City 
district of Cairo on 5 January 2019 exploded during 
defusing, killing the bomb expert. 


Arabian Peninsula 

The humanitarian crisis in Yemen, 
labelled by the United Nations (UN) 
as the most severe worldwide, was 
further exacerbated by the on-going 
conflict between the Huthi rebels 
and the internationally recognised 
government headed by Abdu Rabbo 
Mansur al-Hadi. A Saudi-led military 
alliance named 'Decisive Storm' has 
supported the al-Hadi government 
since 2015, while the Huthi rebels 
allegedly have received increasing 
military support from Iran since 2014. 
Due to the foreign interventions, the 
conflict, which was initially triggered 
mainly by local grievances, has been 
increasingly perceived as a sectarian 
confrontation between Sunni and Shi'i 
forces for hegemony in the region. 

In 2018, the advance of al-Hadi 
government-linked fighters supported 
by the United Arab Emirates (UAE), 
as part of the Saudi-led coalition, on 
the Huthi-held Red Sea coastal city 
of al-Hudayda (Hodeida) threatened 
to disrupt the humanitarian aid flow 
into the country. In December, an 
agreement negotiated by the UN 
between the Yemeni government and 
the Huthis was signed in Stockholm, 
stipulating among other items the de¬ 
militarisation of al-Hudayda. 

In the shadows of the civil war, 
al-Qaeda in the Arabian Peninsula 
(AQAP) maintained a presence, in 
particular in the southern and eastern 
parts of Yemen. In mid-2018, the 
group reportedly had between 6 000 
and 7 000 members. The group's 
activities in 2018 were mainly focused 
on internal activities, fighting at 
the same time the Huthi rebels, the 
Yemeni government and the forces 
of the Saudi-led coalition. AQAP 
continued trying to win support from 
local tribes and recruit their members. 
Its self-proclaimed role in the fight 
against the Huthis has allowed AQAP 
to create alliances with local tribes 
and win support in southern Yemen, 
in particular since the Huthis took 
control of Sana'a in 2015. 


Despite the high numbers of AQAP 
fighters, however, the group's 
wing specialising in attacks on 
Western targets has reportedly been 
significantly reduced in recent years, 
probably as a result of both military 
action targeting its members and the 
competition with local IS affiliates. 

As a result, in 2018, the threat from 
AQAP to Western interests seemed 
diminished. Its broad local base, 
however, might allow the group to 
quickly mobilise forces to replenish 
its international wing should the 
leadership assess it opportune. 



In addition, AQAP remained capable 
of inspiring lone actor attacks 
worldwide. Whilst propaganda 
output was very limited in 2018, 
there remains a significant volume 
of historic English-language material 
available online, including 17 issues 
of the group's inspire magazine. 

These include incitement aimed at 
Westerners and practical guidance for 
lone actor operations. 

In contrast to AQAP, IS affiliates in 
Yemen were said to count not more 
than a couple of hundred fighters 
in 2018 and to be located in roughly 
similar areas as AQAP. In July, IS 
clashed with AQAP in al-Bayda' 
governorate, reportedly after an AQAP 
convoy was shot at an IS checkpoint. 
In a statement released in early 
August, AQAP explained that IS had 
violated an agreement that would 
allow safe passage through each 
other's checkpoints. 
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North Africa 

In Morocco, two women aged 24 and 
28 from Denmark and Norway were 
assassinated on 17 December 2018 
while on a hiking tour near a popular 
tourist spot. A video circulating on 
social media showed the killing of 
one of the women. In another video, 
four alleged perpetrators of the 
assassination pledged allegiance to 
IS. One of the individuals declared 
they were about to act in response to 
the call of the IS leader and in support 
of IS fighters in Hajin, an enclave then 
still under IS control in Syria. IS did 
not formally claim responsibility for 
the killing. In recent years, in several 
instances, terrorist cells related to IS 
have been dismantled in Morocco. In 
contrast, the influence of al-Qaeda 
in the Islamic Maghreb (AQIM) has 
decreased. 

In Tunisia, the Uqba bin Nafi'Battalion, 
AQIM's branch in the country, claimed 
responsibility for a double IED attack 
on Tunisian soldiers on patrol on 4 
October 2018 in Kasserine, in which 
one soldier was killed. After a first 
explosion targeting the patrol vehicle, 
a second explosion occurred when 
other soldiers had gathered around 
the damaged vehicle. Also in Tunisia, 
a Tunisian woman aged 29 detonated 
an explosive device attached to her 
body, on 29 October 2018, in the 
proximity of police officers in the 
centre of Tunis, killing herself and 
injuring 20 people. The perpetrator 
was known to have radicalised, but 
her motivation has remained unclear. 
The attack, the first suicide attack in 
Tunisia committed by a woman, was 
not claimed. 

In Libya, the security situation 
continued to be gravely affected by 
the political split of the country: the 
western part centred around the 
nominal capital Tripoli is the seat 
of the internationally recognised 
Government of National Accord 
(GNA), while the eastern part is 
controlled by the Libyan National 


Army (LNA) militia under Khalifa 
Haftar, nominally reporting to the 
government of the Tobruk-based 
House of Representatives and its 
government in al-Bayda'. In 2018, four 
major militias shared the control of 
Tripoli, thereby securing access to 
resources and assets officially under 
GNA control and excluding competing 
militias from outside the capital. 

In September, allied militias from 
Tarhuna, Misrata and Zintan tried 
to enter the city, leading to violent 
confrontations, which killed more than 
one hundred people and displaced 
thousands. The Tarhuna militia took 
control of the international airport 28 . 

Khalifa Haftar's stated aim has been 
to take control of Tripoli and his LNA 
has expanded its control significantly 
south and west in recent years 29 . The 
LNA is composed of regular troops 
but also tribal militias and religiously 
motivated fighters. Rumours about 
Haftar's health in early 2018 sparked 
fears that a change in the LNA 
leadership might compromise its 
coherence and escalate political and 
military competition in the east of the 
country. 

Libya's uncontrolled south has 
become an increasingly important 
factor in the destabilisation of the 
whole Sahara region and continued 
to be used by AQIM, which has built 
relations with local tribes and IS 
affiliates as a safe haven. 

Since their expulsion from Sirte in 
2016, IS affiliates have remained 
active and, in 2018, perpetrated 
significant attacks in all parts of the 
country. These included several large- 
scale attacks in Tripoli, such as on the 
High National Elections Commission 


28 Another attempt to gain influence in Tripoli by 
violent means led to a renewed outbreak of violence 
in late January 2019. 

29 In January 2019, the LNA launched a large-scale 
attack on the Fezzan region in southern Libya. The 
campaign was officially motivated by the need to 
strike terrorist groups operating in the region, but 
reportedly also aimed to take control of the main 
areas of oil production, which thus far were under 
the control of the GNA. 



on 2 May, the National Oil Corporation 
on 10 September and the foreign 
ministry on 25 December. In the east 
of the country, a VBIED attack in 
Benghazi on 25 May was said by IS to 
have been perpetrated by a 'lone wolf' 
of the 'caliphate'. In southern Libya, 
on 23 November, an attack claimed 
by IS on a police station in Tazirbu in 
territory held by LNA forces killed nine 
people. Ten others were abducted; at 
least six of them were executed some 
days later. 

Italy reported that there is a risk 
that terrorists infiltrate the illegal 
immigration flows, in particular those 
from Tunisia. Crossings from Tunisia 
often include safe delivery at the 
Italian coast that goes unnoticed by 
authorities. Furthermore, Italy pointed 
to the threat of infiltration of terrorists 
into Europe from Libya with the aim to 
carry out terrorist attacks in Europe. 
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West Africa 

Despite regional and international 
efforts aimed to stabilise the region, 
terrorist violence escalated in multiple 
locations of the region in 2018. In 
addition, it was noted that terrorist 
groups, criminals and local militias 
in the Sahel region, while pursuing 
diverging goals, exchange expertise in 
attack modi operandi and explosives. 

In 2018, the security situation in Mali 
continued deteriorating. Terrorist 
attacks targeted local regional and 
international forces. Local forces 
included the Malian military and 
the Mecanisme Operationnel de 
Coordination (MOC), a mixed force 
consisting of Malian military forces 
and tribal militias that cooperate 
under an UN-brokered peace deal. 
Regional forces deployed in Mali 
consist of the G5 Sahel Joint Force, 
which has been established in early 
2017 by Mali, Niger, Chad, Mauretania 
and Burkina Faso with support from 
Western donors, including the EU, 
to combat terrorism, organised 
crime and human trafficking. On the 
international level are the French 
military Operation Barkhane and 
the UN Multidimensional Integrated 
Stabilisation Mission in Mali 
(MINUSMA). 

The predominant terrorist entity 
in Mali and surrounding countries 
remained Jama'at Nusrat al-lslam 
wal-Muslimin (JNIM, 'group in support 
of Islam and Muslims'). This jihadist 
umbrella organisation was created in 
March 2017 and comprises AQIM's 
Sahara branch, Ansar al-Din (Ansar 
Dine, 'supporters of the religion'), al- 
Murabitun and the Fulani-dominated 
Macina Liberation Front 20 . In early 
November 2018, the head of the 
Macina Liberation Front appeared for 
the first time in a video speech flanked 
by his fellow JNIM leaders, calling on 
the Fulani population in West Africa 
to join JNIM and threatening French 
forces in Mali. 


30 Europol, TE-SAT 2018, p. 39. 


JNIM showed increasing capabilities 
to carry out complex attacks in 2018. 
For example, an attack combining 
bombings and armed assault on 14 
April 2018 targeted an international 
military camp near the airport of 
Timbuktu, Mali, killing one MINUSMA 
soldier. The attackers used vehicles 
and uniforms in UN and Malian 
military colours. JNIM claimed that 
the attack was in response to French 
operations and strongly rejected the 
allegation by the French commander 
of Operation Barkhane that a woman 
was among the attackers while 
acknowledging the non-combatant 
contribution of women to the struggle. 

Amid widespread violence, Ibrahim 
Boubacar Keita was re-elected as 
president of Mali in August 2018. 
Flundreds of voting centres in the 
northern and central regions, however, 
remained closed. The elections were 
used by JNIM to question the political 
and economic independence of Mali 
from France, granted 50 years earlier, 
accusing France of continuing to 
exploit Mali. Blaming democracy 
for all ills in Malian society, the 
organisation advocated Islamic shura 
(consultation), the redistribution 
of resources and the resistance of 
Western hegemony as solutions. 

The group accused France of killing 
innocent people in Mali with the aim 
of breaking the increasing resistance 
to its alleged neo-colonial project. On 
29 July 2018, a day before the first 
round of the presidential elections, 
a bomb attack targeted a French 
military and MINUSMA base in Kidal 
province. JNIM claimed responsibility 
and vowed not to rest until the last 
French soldier had left Mali and 
Islamic law was implemented. 

JNIM also targeted other G5 
Sahel countries in an attempt to 
coerce them into abandoning their 
engagement. On 2 March 2018, the 
first anniversary of the announcement 
of JNIM's establishment, the French 
embassy, a French cultural centre 
and the Burkinabe army general staff 
in Ouagadougou, Burkina Faso, were 



targets of a terrorist attack using a 
car bomb and assault weapons by at 
least eight heavily armed militants 
wearing army uniforms. In addition to 
the attackers, eight people were killed. 
JNIM claimed credit for the attack, 
alleging that it was in retaliation 
of French airstrikes in February. It 
warned the Burkinabe government 
to cease its cooperation with the G5 
Sahel. 

In Burkina Faso, terrorist attacks 
increased drastically in 2018, mainly 
in the northern and eastern part of 
the country. Many were the work of 
a jihadist group known as Ansar al¬ 
lslam (Ansaroul Islam, 'supporters of 
Islam'), believed to be the Burkinabe 
offshoot of Ansar al-Din in Mali. The 
founder of Ansar al-lslam, who died 
in mid-2017 and was replaced by his 
brother, was a close ally of the leader 
of the Macina Liberation Movement in 
Mali. 

The faction of al-Murabltun that 
refused to align with AQIM in 2015 and 
has since been known as the Islamic 
State in the Greater Sahara (ISGA) 
remained active in the border region 
between Mali, Niger and Burkina Faso 
in 2018, clashing mainly with Tuareg 
militias supporting the government 
in Mali and military forces in Niger. 

The group has also been accused 
of multiple kidnappings for ransom, 
indicating the close interconnection 
between crime and terrorism in the 
region. For example, on 12 April, the 
group claimed the abduction of a 
school teacher in northern Burkina 
Faso, threatening with death any 
teacher using French in class. Despite 
its pledge of allegiance to IS in May 




jihadist terrorism 


50 


2015, which was disseminated a 
year later through Amaq News, the 
faction's claims and videos have not 
been published through a dedicated 
IS media office or official IS channels. 
According to news reports, ISGA also 
occasionally cooperated with Ansar 
al-lslam in Burkina Faso. A Romanian 
citizen, kidnapped in April 2015 by 
the faction that was to become ISGA, 
remained in captivity in 2018. Also 
in 2018, a German aid worker and 
an Italian priest were kidnapped in 
western Niger in April and September, 
respectively. 

In Nigeria, the jihadist militias jointly 
known as Boko Haram (Hausa for 
'Western education is unlawful [in 
Islam]') continued operating in the 
north-eastern Borno and Yobe states 
as well as neighbouring Cameroon, 
Chad and Niger in 2018. Large-scale 
attacks against a variety of civilian 
and military targets were carried out 
by all factions. For example, on 3 
January 2018, a suicide bombing in 
a mosque during morning prayer in 
Gamboru, Borno state near the border 
with Cameroon, killed more than ten 
people. On Easter Sunday, 1 April 
2018, unidentified fighters attempted 
to enter the capital of Borno state, 
Maiduguri. After being repelled by 
military forces, they attacked nearby 
villages, killing at least 25 civilians 
and one soldier. In addition, the 
practice observed in 2017 of using 
young women as suicide bombers 
continued in 2018. In one occurrence 
on 30 March, four teenage girls 
detonated themselves near Maiduguri, 
killing an additional woman. 

The split between the two major 
factions of Boko Haram, which 
occurred in August 2016, continued in 
2018. The faction that was recognised 
by the IS leadership as the group's 
'West Africa province' continued to 
be active in the Lake Chad region and 
along the border between Nigeria and 
Niger. The Boko Haram faction led by 
Abubakar Shekau subsisted mainly 
in the border region with Cameroon. 


Largely geographically separated— 
only potentially overlapping in 
south-central Borno—the two factions 
competed through their propaganda 
productions, in which both claimed to 
be part of IS. In videos published in 
2018, IS West Africa province showed 
how the areas controlled by it in the 
Lake Chad region provided local 
residents with security and prosperity, 
which the group claimed was the 
reason forthe global enemies of 
Islam to attack it. The Shekau faction 
published videos that used the IS label 
followed by the group's formal name 
adopted in 2015, Jama'atAhl al-Sunna 
lil-Da'wa wal-Jihad ('group of Sunni 
people for preaching and jihad'). A 
topic emphasised by the Shekau 
faction was the implementation of the 
shari'a. IS West Africa province videos 
consistently used Arabic language 
or subtitles and were in line with the 
style and quality of IS videos from 
other regions. By contrast, Abubakar 
Shekau, in a video speech allegedly 
recorded in July 2018, spoke in Flausa 
without Arabic subtitles, suggesting 
that his intended audience was local. 
Whereas it was not always possible 
to attribute specific attacks to a 
particular faction with certainty, in 
general, IS West Africa province 
focused on military targets, whereas 
the Shekau faction is notorious for 
targeting civilians and, in particular, 
using female suicide bombers. 

IS West Africa province came under 
military pressure in 2018. According 
to Nigerian military sources, several 
hundreds of fighters surrendered to 
authorities in Niger and Nigeria. In 
early January, hundreds of people 
held captive on islands in Lake 
Chad were able to flee to Monguno, 
reportedly as a result of military 
strikes against the militia. 

IS West Africa province has nominally 
been headed by Abu Mus'ab al- 
Barnawi, a son of Boko Haram founder 
Muhammad Yusuf. The actual leader 
of the faction, however, was said 
to be Mamman Nur, the suspected 


mastermind of the 2011 attack 
on the UN headquarters in Abuja, 
who reportedly also was behind 
the recognition of the faction by IS. 
According to local media reports, Nur 
was killed on 21 August 2018 by his 
own fighters, allegedly because they 
thought him to be too compromising, 
as for example when releasing a 
large number of abducted school 
girls in March 2018 without apparent 
concessions from the Nigerian 
government 31 . In late February, more 
than 100 girls had been abducted in 
a raid by IS West Africa province on a 
girls' boarding school in Dapchi, Yobe 
state. 

This possible change in leadership 
seems to have resulted in an increase 
in violent activities by IS West 
Africa province. The group attacked 
Nigerian military bases on several 
occasions between September and 
the end of the year. For example, on 
18 November, at least 40 Nigerian 
soldiers were killed in an attack 
on a military base in Metele, Borno 
state, claimed by IS West Africa 
province. On 28 December, IS West 
Africa province seized the fishing 
town of Baga. The attackers burnt 
down a naval base on the shores 
of Lake Chad and took weapons 
from a military camp. In addition, in 
September and October, respectively, 
the group released videos showing 
the killing of two midwives working 
forthe International Committee of 
the Red Cross (ICRC), who had been 
abducted in March in Rann, Borno 
State. The group declared that the 
Nigerian government had refused to 
meet its demands. 


31 Hamza Idris and Ibrahim Sawab, 'Factional Boko 
Haram leader Mamman Nur killed by own fighters', 
Daily Trust, 14 September 2018, https://www. 
dailytrust.com.ng/factional-boko-haram-leader- 
mamman-nur-killed-by-own-fighters.html. 
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Somalia and East 
Africa 

In Somalia, Harakat al-Shabab 
al-Mujahidin (HSM, 'mujahid youth 
movement'), a formal member of a/- 
Qaeda, despite an intensive campaign 
of airstrikes targeting it, maintained 
its control over large stretches of 
land outside urban centres in the 
south-west of the country. It financed 
its activities by taxing and extorting 
local populations and businesses 
in territories under its control and 
beyond, including in Mogadishu. The 
continuing food crisis in Somalia was 
further aggravated by HSM's refusal 
to cooperate with humanitarian 
agencies. People suspected of 
such cooperation were accused of 
espionage. In territories under its 
control, HSM is said to have forced 
parents to hand over their children for 
indoctrination and military training. 
The group continued meting out harsh 
punishments to local residents under 
the pretence of implementing Islamic 
law. 

HSM carried out a multitude of 
large-scale attacks predominantly on 
Somali security forces and forces of 
the African Union Mission in Somalia 
(AMISOM) across the country. In 
Mogadishu, political institutions were 
the predominant targets, including 
the Somali presidential palace, which 
was attacked on 23 February and 14 
July, killing at least 45 and 25 people, 
respectively. On 7 July, an HSM 
attack on the compound housing the 


Somali interior and security ministries 
killed 20 people. Many of the attacks 
combined suicide bombings and 
armed assault. 

On 1 October, HSM claimed 
responsibility for a VBIED attack on an 
EU armoured convoy carrying Italian 
military trainers in Mogadishu, killing 
two civilians. 

HSM attacks also caused high 
numbers of civilian deaths. On 9 
November, for example, VBIED 
explosions killed 53 people in 
Mogadishu. Two explosions occurred 
at a junction and a third near the 
Somalia Criminal Investigation 
Division and a hotel. The fourth 
explosion happened when emergency 
services arrived at the location. The 
attackers reportedly wore uniforms. 

In 2018, tensions between HSM and 
an IS affiliate, led by Abdulqader 
Mu'min and said to be composed 
of about 200 fighters continued, 
with IS trying to extract funds 
from businesses already extorted 
by HSM. In mid-December 2018, 
the situation escalated into open 
violence. On 16 December, IS in 
Somalia claimed responsibility for 
killing 14 HSM fighters in the north¬ 
eastern Puntland region, alleging that 
the latter were preparing to attack 
it. In response, HSM accused IS of 
creating dissension among jihadists 
in the country and ordered its fighters 
to eliminate the 'disease' of IS in 
Somalia. 

HSM-linked networks continued 
perpetrating small-scale terrorist 



attacks in neighbouring countries, 
in particular those contributing to 
AMISOM. In the latter case, such 
attacks aimed to exert pressure 
on governments to withdraw their 
troops from Somalia. In addition, 
HSM sought new recruits and solicit 
funding by escalating tensions 
resulting from local grievances. 
Kenya, for example, suffered several 
assassinations in Muslim-majority 
regions along the coast and in 
the northeast bordering Somalia, 
the targets of which were mostly 
individuals identified with Kenya's 
political system, such as members 
of the Christian community and 
teachers. In contrast, since the 
2015 attack on a Garissa University 
College, HSM had not perpetrated a 
major terrorist attack in the Kenyan 
highlands. This changed in 2019 with 
the attack on a hotel in Nairobi on 15 
January 32 . 


32 On 15 January 2019, a terrorist attack combining 
explosive devices and firearms targeted a hotel 
complex in Nairobi, Kenya. The attackers detonated 
an IED at the parking lot and carried out a suicide 
bombing at the hotel reception area. HSM claimed 
responsibility for the attack. 
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South Asia 

Afghanistan continued to experience 
massive violence in 2018 with 
numbers of civilian casualties 
increasing, compared to 2017. On 
20 January 2018, for example, an 
armed attack was committed on 
the Intercontinental Hotel in Kabul. 
The perpetrators were said to be six 
armed Taleban fighters who were 
killed by Afghan security forces. A 
statement claiming responsibility for 
the attack was issued on the official 
homepage of the Taleban. The attack 
claimed the lives of more than 30 
people, including one German citizen. 

Parliamentary elections, originally 
scheduled for October 2016 and 
initially postponed to 7 July 2018, 
were finally held on 20 October. 
Security concerns and political 
disputes prevented the elections from 
taking place in some parts of the 
country. 



In the run-up to the elections, 
the Taleban reportedly killed 10 
candidates running for parliament 
and carried out multiple attacks 
on election rallies and candidates. 

For example, on 17 October, a 
candidate was assassinated when 
a bomb hidden in a sofa detonated 
in his campaign office. The Taleban 
warned teachers and students not to 
participate in elections or allow their 
schools to be used as polling centres. 

On 18 October, the heads of Kandahar 
police and intelligence were killed in 
an insider attack, when a bodyguard 


opened fire after a meeting with US 
military. In its claim of responsibility, 
the Taleban stated that both the 
Afghan and US officials had been 
the targets of the attack. As a result 
of the assassination, elections in 
Kandahar were postponed by a week. 

In 2018, the Taleban continued 
attempting to establish themselves 
as political actors. In a statement 
released in mid-August, they urged 
direct negotiations with the USA, 
thereby bypassing the Afghan 
government, to achieve a withdrawal 
of US troops from Afghanistan. 

In June, the Taleban announced a 
three-day ceasefire on the occasion of 
Eid al-Fitr, after a unilateral ceasefire 
for the period had been declared by 
the Afghan government. An offer by 
the Afghan government to prolong 
the ceasefire, however, was rejected. 
On 16 June, a VBIED detonated in 
Nangarhar province at a gathering 
that comprised Taleban and Afghan 
forces, killing at least 20 people. The 
attack was claimed by IS Khorasan 
province through an Amaq News 
statement. 

IS Khorasan province continued 
to hold some territory in the 
eastern Nangarhar province on 
the border with Pakistan, where it 
had emerged publicly in 2015. The 
group also claimed responsibility 
for a substantial number of large- 
scale attacks in urban areas across 
the country in 2018. Most of these 
attacks targeted civilians, including an 
attack on a voter registration centre 
in Kabul on 22 April, which killed at 
least 57 people; two coordinated 
suicide attacks in Kabul on 30 April, 
killing at least 29 people, including ten 
journalists; an explosive and firearm 
attack on a midwife training centre in 
Jalalabad on 30 July; and a suicide 
attack on 5 September on a sports 
club in Kabul, which killed 26 people, 
among others. On 15 July, a suicide 
attack targeting Rural Development 
Ministry staff was claimed by IS, 


which alleged that 60 people had 
been killed and that French nationals 
were among the wounded. 

IS Khorasan province also continued 
targeting Shi'is and other Muslim 
communities. On 3 August, two 
suicide bombers wearing burqas 
attacked a Shi'i mosque in Gardez, 
Paktia province, killing at least 39 
people. On 15 August, a suicide 
bomber attacked Shi’i university 
students in Kabul, killing 34 people. 

On 20 November, at least 50 people 
were killed, when a suicide attacker 
detonated his bomb amid a religious 
gathering marking the birthday of 
Prophet Muhammad in Kabul. No 
group claimed responsibility for the 
latter attack. 

In addition, a self-proclaimed IS 
Khorasan province commander 
in Jawzjan province in western 
Afghanistan, who had pledged 
allegiance to IS in 2015 after being 
expelled by the Taleban, managed 
to defend his faction's control over 
two districts in the province despite 
several attempts by local Taleban 
forces to evict them in early 2018. The 
IS commander was killed on 5 April 
in an airstrike in neighbouring Faryab 
province. His faction, which was said 
to contain 300 to 400 fighters, was 
at first able to find a replacement 
but was eventually eliminated by the 
Taleban in early August 2018 after a 
month of fighting. 
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Ethno-nationalist and 
separatist terrorist 
attacks occurred 
exclusively in France, 
Spain and the UK 


Dissident Republican 
groups continued to pose 
a significant threat in 
Northern Ireland 


Separatist terrorist 
activity in Spain remained 
at low levels 


The number of attacks by ethno- 
nationalist and separatist terrorists 
in the European Union (EU) declined 
significantly from 137 in 2017 to 
83 in 2018. As for previous years, 
attacks occurred exclusively in 
France, Spain and the UK. In addition, 
law enforcement agencies in six EU 
Member States arrested a total of 
30 individuals on charges related 
to ethno-nationalist and separatist 
terrorist activity. 

UK - Dissident 
Republican (DR) 
groups 

In 2018, Dissident Republican (DR) 
groups continued to pose a significant 
threat to security in Northern Ireland. 
The threat principally emanated 
from the New Irish Republican Army 
(NIRA), the Continuity Irish Republican 
Army (CIRA), Arm na Poblachta (ANP, 
Army of the Republic) and Oglaigh na 
hEireann (ONH, Warriors of Ireland) 
which split into two factions. All 
groups remained opposed to the 
current peace process and continued 
to be firmly committed to the use of 
violence to achieve their objective of a 
united Ireland. 

DR groups maintained their access 
to a range of firearms and explosives 
and kept planning and executing 


attacks, albeit with hampered 
capability compared to previous 
years. The attacks involved firearms 
or improvised explosive devices 
(lEDs), such as pipe bombs, but the 
use of larger and potentially more 
destructive devices was not observed 
in 2018. Police, corrections officers 
and members of the armed forces 
remained primary targets. However, 
there was just one actual attack 
against police in 2018, using firearms. 

Members of DR groups continued 
to be involved in organised criminal 
activities, including drug dealing, 
extortion, fuel laundering 33 and 
murder. DR groups also sought 
to exert control in their own 
communities by continuing to commit 
extremely violent paramilitary-style 
attacks. 

Spain - Euskadi ta 
Askatasuna (ETA) 
and Resistencia 
Galega 

Separatist terrorist activity in Spain 
remained at low levels in 2018, 
following a declining course since 


33 'Fuel laundering' is removing the dye from low- 
price dyed fuel and selling it illegally at the higher 
price of undyed fuel. 
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2013. Euskadi ta Askatasuna (ETA, 
Basque Fatherland and Liberty) has 
not committed any terrorist attacks 
since August 2009 and in May 2018 
it released a statement in which it 
announced its decision to disband 
and dismantle all its structures. 
Spanish authorities, however, 
continued to carry out operations 
against the group, in 2018, three 
weapons and explosives caches were 
discovered and an investigation into 
documents received from France 
led to the solving of 300 cases of 
ETA-related attacks. In contrast, 
Resistencia Galega maintained its 
commitment to armed struggle to 
achieve its ends in 2018. The group, 
however, has not committed terrorist 
attacks since October 2014 and its 
leadership remained under pressure 
to avoid arrest. 

In 2018, violent separatist activism in 
Spain mainly manifested itself in the 
form of street violence, predominantly 
against communication and 
transportation infrastructure. While 
this caused minor damage, no 
casualties were reported. The main 
perpetrator of these attacks was 
the Ernai group, which is related to 
ETA and has links to Basque radical 
left-wing parties. The aims of Ernai 
and the linked parties remained the 
establishment of an independent 
Basque state and total amnesty for 
imprisoned ETA members. 


Partiya Karkeren 
Kurdistan (PKK) 

In 2018, no terrorist attacks by the 
Partiya Karkeren Kurdistan (PKK, 
Kurdistan Workers' Party) were 
reported in the EU. Nevertheless, 
a number of EU Member States 
pointed out that the PKK maintained 
an apparatus in Europe, which 
provided logistical and financial 
support to Hezen Parastina Gel (FIPG, 
People's Defense Forces) and carried 
out propaganda and recruitment 
activities. In early 2018 for example, 
two individuals were convicted of 
being leading members of PKK 
structures in Germany. 

To sustain the organisation running, 
PKK members and sympathisers 
in the EU raised funds through 
the annual k ampanya (fundraising 
campaign) and collecting 
membership fees, selling publications 
and extorting Kurdish business 
owners. In this context, a Belgian 
court convicted four people in 2018 of 
participating in a kampanya. Turkish 
authorities also reported that PKK 
members were involved in various 
forms of serious organised crime 
and particularly in drug smuggling 
and dealing, migrant smuggling, 
trafficking in human beings and 
money laundering. 


In 2018, the situation in Turkey and 
Syria—in particular the Turkish 
intervention in Afrin, Syria at the 
beginning of the year—impacted 
Kurdish activism in Europe, resulting 
in a number of protest events. 

These were largely peaceful, despite 
some sporadic clashes with Turkish 
counter-protesters. Tensions between 
Kurds and nationalist Turks in the EU 
generally increased. In Germany, there 
was a significant rise in the number 
of offences against Turkish facilities 
(associations, mosques, shops etc.). 

In March 2018, a mosque in Lauffen, 
Baden-Wiirttemberg, was subject to 
an arson attack and six PKK-affiliated 
individuals were arrested on suspicion 
of being involved. Websites linked to 
the PKK described the attack as an 
act of vengeance for Afrin. 

In this context, ties between left-wing 
extremist and Kurdish organisations 
grew stronger in several European 
countries, reinforcing existing 
solidarity between the groups. It was 
reported that groups and individuals 
of the far left-wing scene joined the 
Kurdish activists in their protests. 
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Left-wing and anarchist 
terrorist attacks were 
reported exclusively by 
Greece, Italy and Spain 


The use of lEDs with low 
risk of apprehension was 
preferred 


The number of adherents 
of anarchist extremism 
appears to have remained 
stable 


Anarchists justified their 
violent acts by referring to 
police activities, solidarity 
with imprisoned terrorists, 
political and societal 
issues 


Terrorist attacks 
and suspects 
arrested 

In 2018, a total of 19 completed, failed 
and foiled attacks related to left-wing 
and anarchist terrorism occurred in 
the European Union (EU) - a slight 
decrease for the second consecutive 
year (27 in 2016, 24 in 2017). The 
number of arrests remained on the 
same level (36 in 2017,34 in 2018). 

All attacks and the vast majority of 
arrests were reported by Greece, 

Italy and Spain. The three countries 
continued to be the epicentre of left- 
wing and anarchist terrorist activity in 
theEU. 

As in previous years, terrorist 
groups active in the aforementioned 
countries exclusively belonged to the 
anarchist sphere and demonstrated 
similar ideological and operational 
traits. Anarchist terrorists mainly 
used improvised explosive devices 
(lEDs) in attacks with a low risk of 
apprehension. They continued to 
select their targets among those they 
traditionally consider as enemies, 
such as the police, the judiciary, the 
(far) right-wing parties and the media. 
The current political agenda, such as 
the issue of migration, also played a 
role in their target selection. 

In 2018, there appeared to be no direct 
contact or operational coordination 
between anarchist terrorists in 
Greece, Italy and Spain, apart from 


online expressions of solidarity. The 
Internet remained the main platform 
for claiming responsibility, spreading 
propaganda and attempting to 
internationalise their scope. Despite 
their ideology's limited public appeal, 
the number of adherents of anarchist 
extremism appears to have remained 
stable. 

In Greece, no notable change in 
the frequency and intensity of the 
anarchist terrorist activity occurred 
in 2018. Anarchist militants carried 
out six attacks and a total of 20 
individuals were arrested. Nineteen of 
the arrestees were involved in a ring 
that financially supported imprisoned 
members of terrorist groups: they 
used fake identity cards to perform 
transactions via money transfer value 
systems and, thus, provide the funds 
to the recipients. 

The six attacks that occurred in 2018 
in Greece were carried out against a 
range of targets including the police, 
the judiciary and the media. On 26 
February, for example, the previously 
unknown Enoples Epanastatikes 
Dynameis (Armed Revolutionary 
Forces) group attacked a police 
station in Athens with a hand grenade, 
causing the injury of a passer-by. 
Judicial authorities were targeted 
on two occasions: on 24 March 
members of the Kiklos Assimetrou 
Mitropolitikou Polemou/Federazione 
Anarchica informale - Fronte 
Rivoluzionario Internazionale (Circle 
of Asymmetric Metropolitan Warfare/ 
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Number of failed, foiled, or completed 
attacks and number of arrests for 



2014 2015 


2016 


2017 2018 


Informal Anarchist Federation - 
International Revolutionary Front) 
placed an IED outside the premises of 
the Athens Public Prosecution Office; 
and on 13 November, an IED that did 
not explode was placed by unknown 
perpetrators in a motorcycle that 
was parked outside the residence of 
a high-ranking prosecutor in Athens. 
Members of Omada Laikon Agoniston 
(Group of Popular Fighters) used an 
IED to attack the headquarters of a TV 
station in Athens and damaged the 
fagade of the building. Of note was 
also the explosion outside a church in 
central Athens on 27 December that 
resulted in the injury of two people 
and for which the individualidades 
Teniendo a lo Salvaje (Individuals 
Tending to the Wild) group claimed 
responsibility with a text published on 
the Internet. 

In Italy, anarchist terrorist groups and 
individuals continued their activities 
following known patterns. The 10 
attacks that occurred in 2018 were 
consistent with the modi operandi 
and intensity seen over the previous 
five years. The Federazione Anarchica 
informale/ Fronte Rivoluzionario 
internazionale (FAI/FRI, Informal 


Anarchist Federation/International 
Revolutionary Front) is considered 
to be the most dangerous group. 

It is infamous for its campaigns 
against Italian and foreign targets, 
predominantly using lEDs, including 
victim-operated lEDs (VOIED, e.g. 
parcel bombs). It pursues an anarchist 
agenda with a view to internationalise 
its activity and its members tend to 
claim responsibility for the attacks 
using various 'cell' names. For 
example, the Haris Hatzimihelakis 
Cell/black international (1881/2018) 34 
claimed responsibility for an attack on 
the headquarters of the Lega political 
party in Villorba (near Treviso) on 
12 August 2018. The perpetrators 
apparently attempted to cause 
fatalities among the police by placing 
two lEDs, one of which was scheduled 
to explode after the arrival of the first 
responding officers. An arson attack 
damaging the entrance of the robotics 
laboratories of the Italian Technology 
Institute on 24 December 2018 was 
claimed in the name of the FAI/FRI 
immediate Action Group. 


34 Haris Hatzimihelakis is a convicted member of the 
Greek anarchist terrorist group Conspiracy Cells of 
Fire/ FAI/FRI. 


Other anarchist terrorist groups in 
Italy targeted premises belonging to 
parties and groups from the right and 
far right of the political spectrum. This 
was reportedly due to the position 
of these parties on the issue of 
migration. On 20 February, unknown 
perpetrators threw two improvised 
incendiary devices (IIDs) - in this case 
Molotov cocktails - at the entrance 
of the office of the right-leaning 
group Azione Universitaria. A group 
calling itself Brigata Belgrado Pedrini 
claimed responsibility for the attack 
by posting a message online. On 13 
October, a rudimentary IED caused 
damage to the fagade of the offices 
of the Lega political party in Ala (near 
Trento). Although no group claimed 
responsibility for the attack, the 
modus operandi pointed to anarchist 
militants based in Trento. On 7 May, 
an IED exploded at the entrance of the 
building of the CasaPound far-right 
political party in Trento. No group 
claimed responsibility for the attack. 

In Spain, left-wing and anarchist 
terrorist activity remained low in 
2018, a fact reflected in the number 
of both attacks and arrests. Three 
arson attacks were attributed to left- 
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Number of failed, foiled, or completed 
attacks and number of suspects 
arrested for left-wing and anarchist 
terrorism in EU Member States in 
2018 . 

attacks O arrests 


wing and anarchist militant groups or 
individuals, all of which were carried 
out against private companies. In 
addition, the three arrests carried out 
by the Spanish authorities were related 
to left-wing terrorist activity outside 
Spain, in execution of international 
arrest warrants. 

The Syrian issue remained relevant to 
the extreme left-wing and anarchist 
milieu. The conflict has in the past 
attracted a small number of European 
left-wing and anarchist extremists 
who travelled to the country in order 
to fight alongside Kurdish militias. The 
impact of their participation in combat 
activities on EU security has yet to be 
assessed. In Slovakia and Czechia, 
left-wing and anarchist extremists 
staged demonstrations outside 
the premises of Turkish diplomatic 
missions in protest against Turkish 
policies in northern Syria. 

Left-wing terrorist groups in the 
EU appear to have ceased their 
operational activities. In Turkey, 
however, groups such as the 


Greece 



Spain 


34 3 


Marxist-Leninist Devrimci Halk 
Kurtulus Partisi-Cephesi (DHKP-C, 
Revolutionary People's Liberation 
Party-Front) retained their intent and 
capability to carry out violent attacks. 
In 2018, authorities in Turkey arrested 
numerous DFIKP-C members and 
seized large amounts of explosives 
and weapons in a number of police 
operations. DFIKP-C members 
remained present in several EU 
countries to provide logistical support 
for operations on Turkish soil and/or 
to avoid being arrested in their home 
country. In Spain, for example, two 
individuals were arrested in execution 
of international arrest warrants issued 
by Turkey on charges related to their 
participation in DFIKP-C. 

Violent extremist 
activities 

In 2018, no significant change 
occurred regarding the violent 
activities of left-wing and anarchist 
extremists. Groups and individuals of 



France 


3 


the anarchist movement continued 
to be more violent than those of the 
extreme left-wing and pose a threat to 
the public order of several EU Member 
States. Their activity was consistent 
with trends observed across Europe. 
Namely, they formed unstructured 
groups operating in and around 
specific urban areas; participated 
in rallies and protests during which 
they attempted violent acts; collected 
funds for imprisoned like-minded 
people; and occasionally carried out 
attacks using IIDs. 

Anarchists justified their violent acts 
by referring to typical themes of their 
ideology, such as police activities, 
squat evictions and solidarity with 
imprisoned terrorists. Trending 
political and societal issues were also 
used as pretexts for launching attacks. 
Migration continued to be central in 
the anarchist rhetoric, in particular in 
conjunction with the rivalry between 
anarchists and the far right. In this 
context, left-wing and anarchist 
extremists tended to become more 
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violent when confronted with right- 
wing extremists in counter-protests 
and rallies. 

In addition to targeting members 
of the far right, anarchists also 
attacked law enforcement premises 
and personnel; banks and other 
financial institutions; public 
property; and private businesses. 

The attacks largely occurred during 
large demonstrations and rallies, in 
which anarchist extremists used the 
crowd as a cover in order to carry 
out violent acts. These included 
throwing Molotov cocktails and 
stones as well as physical assaults 
against the police. In France, left-wing 
and anarchist extremists exploited 
the fact that police forces were 
concentrated in Paris due to the g/'/efs 
jaunes protests and carried out violent 
activities in provincial cities with 
smaller police presence. In Germany, 
a number of violent incidents 
occurred when law enforcement 
cleared the Hambacher Forst forest 
area that was occupied by members 


of the left-wing and anarchist 
movement. Several police officers 
were injured and numerous protesters 
were arrested in the course of the 
clearing. In addition, an increase in 
the number of criminal offences, such 
as arson and damage, was recorded 
in the country and is believed to be 
linked to the specific police operation. 

Left-wing and anarchist extremists 
made use of the Plambacher Forst as 
a setting for international networking. 
Dutch activists, for example, visited 
the area in March 2018 and received 
ideological and operational training. 
Furthermore, members of the violent 
anti-fascist movement were reported 
to be cooperating in the Nordic 
countries, with Swedish, Norwegian 
and Danish activists coordinating 
activities in Sweden. Likewise, Greek 
left-wing and anarchist extremist 
groups and individuals continued 
to interact extensively with the 
international anarchist community 
and maintained links with members of 
other organisations outside Greece. 


Left-wing and anarchist extremists 
in the EU also sought out high- 
profile events with extensive media 
coverage. In September 2018, for 
instance, they staged attacks against 
the police during the Summit of EU 
Pleads of State and Government in 
Salzburg (Austria). Furthermore, 
a number of protests took place 
in Brussels (Belgium) during EU 
summits. 
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The right-wing extremism 
scene varies significantly 
between and within EU 
Member States 


One right-wing terrorist 
attack was reported in 
2018 in the EU 


Escalation of extreme 
right-wing sentiments 
across Europe resulted in 
increase of arrests 


Despite the increase of extreme 
right-wing sentiments across Europe, 
only one right-wing terrorist attack 
in the EU was reported in 2018. In 
Italy, a man carried out a shooting 
spree on 3 February in Macerata. 
During the attack, which lasted for 
two hours, he wounded six people 
whom he thought were Africans. The 
suspect was charged with multiple 
counts of attempted murder. The 
incident occurred after the murder of 
an Italian teenager, in connection with 
which three Nigerian suspects were 
arrested. In 2017, the perpetrator had 
run unsuccessfully for local elections 
for the anti-migrant Lega Norte 
(Northern League). 

A total of 44 people were arrested 
in Czechia, France, Germany, Italy 
and the Netherlands on suspicion 
of offences related to right-wing 
terrorism. Attack preparation and 
attempts to commit a terrorist act 
were the most frequently reported 
offences. Additionally, 15 individuals 
were charged in Slovakia with right- 
wing extremist (RWE) activities. The 
suspects created a formal group 
called Felvideki Harcosok (Flungarian 
for 'Upland Warriors') and displayed 
modified fascist symbols during 
sports events on flags, banners and 
tattoos. The group expressed hatred 
towards ethnical minorities via social 
media. 


While the vast majority of right- 
wing extremist groups across the 
EU have not resorted to violence, 
they nevertheless help entrench a 
climate of fear and animosity against 
minority groups. Such a climate, 
built on xenophobia, anti-Semitic, 
Islamophobic and anti-immigration 
sentiments, may lower the threshold 
for some radicalised individuals to 
use violence against persons and 
property of minority groups. 

The right-wing extremism scene 
varies significantly between and 
within EU Member States. Factions 
include National Socialist and neo- 
Nazi groups, revisionist individuals 
and groups, racist and anti-Semitic 
groups and skinhead and right-wing 
extremist hooligan groups. In Czechia, 
for example, the right-wing extremist 
scene is mainly represented by the 
Generace Identity (Generation of 
Identity) movement and the newly 
established Narodni a socialnl 
fronta (National and Social Front). 
Paramilitary groups and so-called 
home-defence groups were also 
active in Czechia, but their activities 
were in decline. 

The right-wing extremist scene 
in Germany is characterised by 
a high affinity for weapons and 
explosives and is composed of neo- 
Nazi elements, Kameradschaften 
(comradeships), loose networks 
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2014 2015 


of right-wing extremists from 
different sub-cultures, the so- 
called 'intellectual right' and right- 
wing populist/extremist political 
parties. Notable examples include 
the Revolution Chemnitz group and 
the Reichsburgerbewegung (Reich 
Citizens movement). Issues related 
to immigration policies and offences 
allegedly committed by migrants 
repeatedly mobilised significant 
numbers of people from the right- 
wing spectrum. On 26 August 2018, 
a German national was fatally 
stabbed during violent clashes in 
Chemnitz, Saxony. A Syrian and an 
Iraqi national, both asylum seekers, 
were arrested as a result. In reaction 
to the stabbing, demonstrations and 
vigils were held in Chemnitz, Saxony 
and throughout Germany. Two weeks 
later, a group of at least 15 right- 
wing extremists, including members 
of the Revolution Chemnitz group, 
attacked several individuals from a 
migrant background. In February 2018 
a Reichsburger fired several shots 
at an accommodation for asylum 
seekers in Kaiserslautern and put up 
considerable resistance at his arrest, 
injuring two police officers. 


Number of failed, foiled, or 
completed attacks and number of 
arrests for right-wing terrorism from 
2014to 2018. 


12 
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2016 


20 



2017 


44 



2018 


Migration is also a major theme for 
Italian right-wing extremist groups. 
The presence of refugee centres in 
Italy and the influx of immigrants fuels 
right-wing extremism in the country. 

In the Netherlands, perceived 
Islamisation of the country and 
loss of Dutch identity are important 
drivers for right-wing extremists. 
Known groups include Pegida 
(from the German Patriotische 
Europaer gegen die islamisierung des 
Abendlandes, Patriotic Europeans 
against the Islamisation of the 
Occident), Voorpost (Forepost) 
and Rechts in verzet (Right-Wing 
Resistance). Flowever, the right-wing 
extremist scene in the Netherlands 
is fragmented and has remained 
relatively small, with only one group, 
the anti-Semitic and anti-democratic 
Erkenbrand, reported to have 
increased membership numbers in 
2018. 

Right-wing extremists in the 
Netherlands increasingly encouraged 
and glorified violence against Muslims 
and the government and the majority 
of protests and demonstrations 
targeted mosques. Flowever, there 
have been no reports of violent 


attacks in 2018. Some groups appear 
to have gained enough confidence 
to organise demonstrations in 
traditionally left-wing cities such as 
Amsterdam and Nijmegen, increasing 
the likelihood of clashes with far-left 
counter-demonstrators. 

The Netherlands reported that 
some Dutch groups, e.g. Pegida, 
maintain relationships with partner 
organisations in Belgium, Germany 
and the UK and participate in each 
other's demonstrations. Similar 
international contacts between 
right-wing extremists are also seen 
elsewhere in the EU. The Austrian 
identitare Bewegung (Identitarian 
Movement) collaborated with its 
counterparts in Europe with the 
aim of countering their perceived 
Islamisation of the Western world. 

In the same way, Polish right-wing 
extremist groups are focused on 
developing contacts with peer groups 
abroad. In Portugal, Blood and Honour, 
Portugal Hammer Skins and the 
recently emerged neo-Nazi political 
party Nova Ordem Social (New Social 
Order) are active at both national and 
international levels. Moreover, the 
right-wing extremist music scene in 
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Number of failed, foiled, or completed 
attacks and number of suspects 
arrested for right-wing terrorism in EU 
Member States in 2018. 
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various EU Member States attracted 
followers from across the EU and 
beyond. 

In Sweden, the right-wing 
extremist organisation Nordiska 
Motstandsrorelsen (NMR, Nordic 
Resistance Movement) remained the 
most prevalent organisation in the 
milieu. It is a pan-Nordic movement 
and has affiliates in Denmark, Finland 
and Norway, although the NMR's 
main base and leadership is located 
in Sweden. Since 2015, the NMR has 
pursued political ambitions and in 
September 2018 fielded candidates 
forthe Swedish general elections. 

The organisation failed to gain any 
seats on the national, regional or 
local level. During the past few years, 
individuals outside the traditional 
right-wing extremist scene who share 
a common xenophobic ideology - 
whilst not committing ideologically 
motivated crimes - have become 
more prevalent in Swedish society. 
This has manifested itself, inter alia, in 
the increased popularity of alternative 
online news sites and the formation of 


a loosely formed alt-right movement. 
The majority of activism in support 
of these ideas is legal and Internet- 
based. 

A number of right-wing extremists 
were convicted in Sweden of 
ideologically motivated crimes, mainly 
physical assault, property damage, 
illegal possession of narcotics and 
offences against the Knives Act 35 . 
There are also reported ties between 
the right-wing extremist scene and 
outlaw motorcycle gangs, which in 
turn are involved in organised crime in 
Sweden. 

The UK also reported high levels 
of rhetoric promoting violence 
and terrorist tactics in right-wing 
extremist circles. The last two 
years have seen a shift to right-wing 
extremist groups attracting a much 
younger demographic. In September 
2018, two 15-year-olds, who were 
assessed to hold right-wing extremist 
views, were arrested on suspicion of 


35 Swedish law prohibits the carrying of knives in 
public areas. 


France 


Netherlands 


: 2 


being involved in the commission, 
preparation and instigation of terrorist 
acts. More recently, in December 
2018, a 17-year-old linked to the 
Sonnenkrieg Division 36 pleaded 
guilty to two counts of encouraging 
terrorism. 

Switzerland reported that right- 
wing extremists maintain a low 
profile in the country and that very 
few incidents have been recorded 
(potentially due to under-reporting). 

In Greece, the main targets of right- 
wing extremists were anarchist/ 
anti-authoritarian individuals and 
groups. In 2018, modi operandi 
included the use of low-impact 
improvised explosive devices (lEDs) 
and improvised incendiary devices 
(IIDs) against premises associated 
with individuals with leftist/anarchist 
ideologies. 


36 Assessed to follow a similar ideology to the far- 
right group National Action (UK). 
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6 Single-issue 
terrorism 


In 2018, one attack was 
classified as single-issue 
terrorism in the European 
Union (EU). It targeted a 
butcher's shop in Athens 
(Greece) in late December. 

The attack was perpetrated 
with the use of an improvised 
incendiary device (IID) and 
an animal-rights extremist 
group named Mavroprasini 
Midenistes (Black- 
green Nihilists) claimed 
responsibility for the attack. 
This was the first single-issue 
terrorist attack reported in the 
EU since 2014. 

The threat from single¬ 
issue activism continued 
to be predominantly 
related to animal rights 
and environmentalism 
and was largely limited to 
online campaigns and non¬ 
violent demonstrations by 


decentralised groups without 
strong cohesion. More 
dynamic actions included 
the blocking of access to 
buildings or infrastructure 
(e.g. animal farms or mines); 
freeing animals; and threats 
against land owners. In 
the UK, the animal rights 
movement also targeted 
supermarkets supplying 
meat and dairy products, 
clothing chains using fur and 
leather and travel agencies 
involved in the transportation 
of animals. In addition, a 
number of minor violent acts 
occurred in 2018, mainly 
involving criminal damage to 
butcher shops and abattoirs, 
wind turbines and private 
businesses involved in 
infrastructure construction. 


© 

For 2018 the first single¬ 
issue terrorist attack in 
the EU since 2014 was 
reported 


Single-issue activism 
continued to be largely 
limited to online 
campaigns and non¬ 
violent demonstrations by 
decentralised groups 
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annex 1 

Amendments to National Legislation 
on Terrorism in 2018 


Austria 

On 1 October 2018 a number of 
provisions, which align the Austrian 
legislation with the requirements 
of Directive (EU) 2017/541 of 
the European Parliament and of 
the Council of 15 March 2017 on 
combating terrorism and replacing 
Council Framework Decision 
2002/475/JHA and amending Council 
Decision 2005/671/JHA, came into 
force. Most notably, the criminal 
offence of 'travelling for purpose of 
terrorism' was introduced as Section 
278g of the Austrian Criminal Code. 
Furthermore, a number of cybercrime 
offences were added to the list of 
possible terrorist offences in Section 
278c of the Austrian Criminal Code. 
The maximum punishment for all 
varieties of the offence 'membership 
in a terrorist association' was set at 
15 years of imprisonment. Finally, a 
specific group of victims of terrorist 
attacks was established and invested 
with rights slightly exceeding the 
usual victim rights in the Austrian 
Code of Criminal Procedure. 

Finland 

A number of amendments were 
made to Chapter 34a of the Criminal 
Code of Finland, which concerns 
terrorist offences. All amendments 
were required by the Directive (EU) 
2017/541 of the European Parliament 
and of the Council of 15 March 2017 
on combating terrorism and replacing 
Council Framework Decision 
2002/475/JHA and amending Council 
Decision 2005/671/JHA. The main 
amendments, which entered into 
force on 15 November 2018, include 
the following: 


Section 1 on offences committed 
with terrorist intent was broadened 
to include a provision on aggravated 
damage to data, aggravated 
interference with communications 
and aggravated interference with a 
data system (Paragraph 4). These 
offences will be punished by an 
imprisonment sentence of four 
months to seven years. A new Section 
la was included on offences involving 
the production, purchase, possession 
and other listed activities related to 
radiological weapons committed 
with terrorist intent. These offences 
will be punished by an imprisonment 
sentence of four months to eight 
years. Other provisions were, 
consequently, modified to reflect 
these amendments. 

The provision on training for the 
commission of a terrorist offence 
(Section 4b) was amended with the 
criminalisation of self-studies. The 
restrictions on the offender and 
the destination in the provision on 
travelling for the purpose to commit 
a terrorist offence (Section 5b), 
were abolished. As a result, it is 
now an offence to travel to another 
country with terrorist intent. It is also 
criminalised to return or to travel to 
Finland with terrorist intent. 

A new Section 5c was introduced 
which criminalises the promotion 
of travelling for the purpose to 
commit a terrorist offence. Such 
offences are subject to a fine or a 
term of imprisonment up to one 
year. Financing of such promotion 
was criminalised with amendments 
made to the provision on financing of 
terrorism (Section 5). 


Lithuania 

Amendments to Articles 250, 250 
and 252 of the Lithuanian Criminal 
Code were changed by the Law of the 
Seimas (Lithuanian Parliament) of 
the Republic of Lithuania No. XIII- 
1682. These amendments entered 
into force on 12 December 2018. 

Most importantly, Article 250 (2) 
was reworded and a new fragment 
concerning electronic data was 
added. 

A new paragraph, Paragraph 75, 
concerning information promoting or 
inciting terrorist crimes was added 
to Article 2 of the Law on Provision 
of Information to the Public. Parts of 
Article 19 (1) concerning information 
not to be published were rephrased. 
Changes were also introduced in 
Articles 22,31 and 33, to make 
reference to a relation with organised 
criminal groups in the past. 

Changes were further made to 
the Law on Public Procurement 
Conducted in the Area of Defence and 
Security. Article 34, which concerns 
the conditions under which suppliers' 
participation in procurement is 
restricted and forbidden, was 
changed to include persons who in 
the last five years were convicted for 
a terrorist crime or a crime related to 
terrorist activity. 

Article 26 of the Law on Management 
Companies of Collective Investment 
Undertakings Tailored for 
Professional Investors was amended 
to include the possibility to prevent a 
person who violated the Law on the 
Prevention of Money Laundering and 
Terrorist Financing and was given 
an administrative penalty (or other 
measure of influence) within less than 
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three years, from being a member 
of the management or supervisory 
body of such undertakings. Similarly, 
amendments were made to Article 12 
of the Law on Collective Investment 
Undertakings for Informed Investors, 
which concerns the acquisition, 
transfer of qualified statutory 
capital and (or) voting rights and 
requirements for owners of qualified 
share of statutory capital and (or) 
voting rights. 

With regard to the Law on the 
Prevention of Money Laundering and 
Terrorist Financing, changes were 
made to Articles 2 and 14 (Enhanced 
customer due diligence), changing 
the former reference to 'politically 
exposed natural persons'to 'politically 
vulnerable (affected) persons'. Further 
changes were introduced to Articles 
2,15 and 25 of the same law. 

Article 33 of the Law on 
Administration of Taxes, was changed 
to include a reference to the Law on 
the Prevention of Money Laundering 
and Terrorist Financing regarding the 
notion of the 'beneficiary of benefit'. 

A new paragraph to Article 12 of the 
Law on State-Guaranteed Legal Aid 
was added to include the victims 
of criminal acts of terrorism to the 
'Persons Eligible for Secondary Legal 
Aid Regardless of the Property and 
Income'. Articles 10 ('Loyalty to the 
State of Lithuania') and Article 59 
('Compensation in cases of death 
or health impairment of an officer or 
cadet') of the Internal Service Statute 
of the Republic of Lithuania were 
reworded. Article 10 now provides that 
those who 'participate or participated 
in activities of terrorist organisation 
or terrorist group [...]' shall be deemed 
disloyal. Article 171 (1) of the Law on 
Collective Investment Undertakings, 


which establishes the grounds and 
the procedure for applying measures 
of influence, now indicates that such 
measures shall be applied in the 
event that a management company or 
investment company fails to comply 
with the requirements of the Law on 
the Prevention of Money Laundering 
and Terrorist Financing. 

Amendments were also made 
to the Law on the Protection of 
Objects of Importance to Ensuring 
National Security. Persons related to 
international terrorist organisations 
(Article 11) and persons who have 
participated in the activities of a 
terrorist organisation or a terrorist 
group (Article 17) are considered no 
to be in compliance with interests 
of national security or may not hold 
the positions specified in the 'List of 
Positions'. 

Finally, changes were introduced 
in the Decision 'On Implementation 
of the Law on Radiation Protection' 
(section 1.3) and in the Schedule for 
the Procedure of Establishing Threat 
Level of a Terror Act, Announcement 
Thereof and Readiness (sections 2, 

10,11 and annex 1). 

Luxembourg 

Through the Law of 27 June 2018, 
amendments were made to the Code 
of Criminal Procedure (CCP), to the 
Law of 30 May 2005 on the protection 
of private life in the field of electronic 
communications and to the Law 
of 27 February 2011 on electronic 
communications networks and 
services. 

Article 39(1) of the CCP was modified 
to include a possibility to extend (with 
the authorisation of an investigating 
judge) the initial retention period of 


24 hours, with an additional retention 
period of 24 hours for persons 
suspected of crimes against the 
security of the State, terrorism or 
financing of terrorism, before being 
brought before an investigating judge. 

Article 65 of the CCP was amended 
to allow house searches at 
anytime of the day or night for 
terrorist or terrorist financing 
offences and crimes against the 
security of the State; for all other 
offences, and except where there 
is an in flagranti situation (en cas 
d'infraction flagrante), searches 
can only be conducted upon order 
of an investigating judge between 
6:30 and 24:00. Two new sections 
(Livre premier, Titre II, Chapitre XI 
et XII) were introduced to allow the 
judicial police to use a pseudonym in 
electronic communications. 

Slovakia 

As of 1 July 2018, a new definition 
of terrorism was introduced in the 
Slovak Criminal Code. The previous 
definition was redrafted and new 
provisions on terrorism-related 
acts were added. Such acts include 
participation in terrorist activities, 
terrorism financing and travelling for 
the purpose of terrorism, for which 
specific definitions were laid down. 

Terrorism-related definitions can now 
be found in Sections 419 (Terrorist 
Attack), 419b (Certain Forms of 
Participation in Terrorism), 419c 
(Terrorism financing) and 419d (Travel 
for the Purpose of Terrorism) of the 
Criminal Code. 
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Sweden 

By amendments in Swedish 
legislation, which entered in to force 
on 1 September 2018, there has been 
a widening of the scope of several 
criminal statutes in the area of 
terrorism. The new legislation implies 
inter alia the following. 

The provision in Section 3 of the Act 
on Criminal Responsibility for Terrorist 
Offences (2003:148), the Terrorist 
Offences Act - which states which 
acts constitute terrorist offences 
under certain Circumstances under 
Section 2 of the same Act - was 
expanded to essentially also cover 
gross breach of data. 

The penal provision in the 
Recruitment Act on training was 
expanded and a special criminal 
liability was introduced for 'self-study'. 

A penal provision on travel in Section 
5b of the Recruitment Act was 
expanded to also cover travel to 
countries of citizenship (not Sweden). 

The penal provisions on financing of 
terrorism were expanded to cover not 
only financing of particularly serious 
crime, but also financing of complicity 
in particularly serious crime or 
attempts, preparation or conspiracy 
to commit such crime. 

Finally, the new legislation also 
implies that jurisdiction was expanded 
in certain cases. 

The purpose of the legislation is to 
ensure that Sweden has legislation 
consistent with the Directive (EU) 
2017/541 Directive (EU) 2017/541 
of the European Parliament and of 
the Council of 15 March 2017 on 
combating terrorism and replacing 
Council Framework Decision 


2002/475/JHA and amending Council 
Decision 2005/671/JHA and the 
Additional Protocol to the Council of 
Europe Convention on the Prevention 
of Terrorism. 

United Kingdom 

The Sanctions and Anti-Money 
Laundering Act (SAMLA) 2018 
achieved Royal Ascent on 23rd March 
2018. It will enable the UKto continue 
to implement UN sanctions regimes 
and to use sanctions to meet national 
security and foreign policy objectives. 
This will allow anti-money laundering 
and counter-terrorist financing 
measures to be kept up to date, help 
to protect the security and prosperity 
of the UK and continue to align the UK 
with international standards. 

It provides a framework for allowing, 
where appropriate, sanctions 
currently implemented through the 
EU to take effect in the UK. This 
includes counter-terrorism sanctions. 
It also provides for the UK to exercise 
sanctions powers autonomously, 
replacing the powers contained in the 
Terrorist Asset-Freezing etc. Act 2010. 

SAMLA is currently divided into three 
parts: 

> Part 1 (sections 1 - 48) provides 
powers to create sanctions 
regimes and contains procedures 
relating to the review of sanctions. 

> Part 2 (sections 49 to 51) provides 
powers to create anti-money 
laundering and counter-terrorist 
financing regulations and contains 
provisions relating to registers 

of beneficial owners of overseas 
entities and beneficial owners of 
companies registered in British 
Overseas Territories. 


> Part 3 (sections 52 to 65) contains 
general provisions supporting 
Parts 1 and 2 of the Act, including 
definitions. The Act also has 3 
Schedules. 

Schedule 1 makes further provision 
about regulations which impose trade 
sanctions. Schedule 2 makes further 
provision about regulations for the 
purposes of anti-money laundering 
and counter-terrorist financing and 
relates to section 49 in Part 2 and 
schedule 3 makes consequential 
amendments to other legislation. 

Currently sections 1 - 48, 50 - 65 
and Schedule 1 and 3 are in force. 

The following provisions are not yet 
in force and will be given effect at a 
later date; 

> Section 49, which enables 
Ministers to make regulations 
about money laundering and 
terrorist financing. 

> Section 51, which requires the 
Secretary of State to provide all 
reasonable assistance to the 
Governments of British Overseas 
Territories to enable them to 
establish publicly accessible 
registers of beneficial ownership 
of companies and, no later than 
31 December 2020, prepare a 
draft Order in Council requiring the 
Government of any such Territory 
that has not introduced such a 
register to do so. 

> Schedule 2, which provides 
further detail on the scope of the 
regulations that can be made under 
section 49. 
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annex 2 

Overview of the foiled, failed and 
completed attacks in 2018 per EU 
Member State and per affiliation 


This annex contains statistical information on the terrorist attacks (foiled, failed 
and completed) in 2018 in the EU as reported to Europol. It highlights key figures 
and, where relevant, compares those with the figures for previous years. 


Member State 

Jihadist 

terrorism 

Left-wing 

terrorism 

Right-wing 

terrorism 

Ethno- 

nationalist Single-issue .. . . 

. .. . . Not specified 

and separatist terrorism r 

terrorism 

Total 

Belgium 

1 



- 

1 

France 

10 



20 

30 

Germany 

2 



- 

2 

Greece 


6 



7 

Italy 

1 

10 

1 

1 

13 

Netherlands 

4 



1 

4 

Spain 

1 

3 


7 

11 

Sweden 

1 




1 

United Kingdom 

4 



56 

60 

Total 

24 

19 

1 

83 1 1 

129 

> In 2018, nine EU Member States reported terrorist 
attacks in 2018. The total number of the attacks 
decreased after a sharp spike in 2017 (205); 

> 

France (7), Germany (2), Italy (1), the Netherlands 
(2), Sweden (1) and the UK (3) reported successfully 
disrupted jihadist terrorist plots; 


> 13 victims died as a result of terrorist attacks and 53 
people were injured (in 2017,68 and 844 respectively); 

> Terrorist attacks specified as ethno-nationalist 
and separatist 37 continued to represent the largest 
proportion (more than 60 %), however declined 
significantly compared to 2017 (137); 

> The number of foiled, failed and completed jihadist 
terrorist attacks decreased compared to 2017, from 33 
to 24. The number of reported foiled terrorist attacks 
considerably outnumbered the completed attacks (16 
out of 24); 


> The Netherlands reported jihadist attacks after a long 
period of having been unaffected by the phenomenon. 
Notable decrease in jihadist attacks in the UK (14 in 
2017, 4 in 2018); 

> The number of left-wing affiliated terrorist attacks 
continued to slightly decrease for the third consecutive 
year (from 27 in 2016, to 24 in 2017 and 19 in 2018). 
Three countries remain the epicentre of left-wing and 
anarchist terrorist activity in the EU; 

> A decrease in completed right-wing attacks compared 
to 2017 (previous year five right-wing attacks were 
reported by the UK); 


> The first single-issue terrorist attack in the EU since 

37 56 attacks reported by the UK were acts of security-related incidents in 2014 W3S reported. 

Northern Ireland. 
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annex 3 

Arrests in 2018 per EU Member State 
and per affiliation 


This annex contains statistical information on terrorist arrests in 2018 in the EU 
as reported to Europol. It highlights key figures and, where relevant, compares 
those with the figures for previous years. 


Member State 

Jihadist 

terrorism 

Right-wing 

terrorism 

Left-wing 

terrorism 

Ethno- 
nationalist 
and separatist 
terrorism 

Singe-issue 

terrorism 

Not specified 

Total 

Austria 

35 






35 

Belgium 

17 





149 

166* 

Bulgaria 

14 


- 

- 

- 

- 

14 

Czechia 


1 



1 


2 

Denmark 

3 




- 

- 

3 

France 

273 

32 

3 

2 



310 

Germany 

43 

8 


5 


3 

59 

Greece 

2 


20 




22 

Italy 

40 

1 

8 

2 


5 

56 

Luxembourg 

1 






1 

The Netherlands 

45 

2 


1 


1 

49 

Poland 






2 

2 

Slovakia 





1 


1 

Slovenia 





1 

1 

2 

Spain 

29 


3 

20 



52 

Sweden 

7 






7 

Romania 

2 






2 

United Kingdom 






273 

273** 

Total 

511 

44 

34 

30 

3 

434 

1056 


*17 arrests were contributed by Belgium in line with TE-SAT methodology. 149 arrests were contributed with no affiliation 
specified; however, the majority were related to jihadist terrorist activities. A total number of terrorist arrests in Belgium is 
166. 

**The UK contributed 273 arrests were not disaggregated by type of terrorism, and do not include 148 arrests made in 
Northern Ireland. 
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> In 2018,18 EU Member States reported a total of 1056 
individuals arrested for terrorism-related offences. 
Compared to previous year, the overall number of 
arrestees remained highest in France and in the UK (in 
2017,411 and 412 respectively out of 1219 individuals 
arrested); 

> Most arrests were made on suspicion of preparing or 
attempting to commit a terrorist act; and a membership 
of a terrorist group, including while being abroad; also 
terrorism financing; 

> Similar to 2017, arrests for jihadist terrorism represented 
the largest proportion of the total arrests for terrorism- 
related offences in the EU (705 out of 1219 in 2017); 


> The number of arrests for left-wing terrorist offences 
remained on the same level (36 in 2017), similar to the 
arrests for separatist terrorist offences (30 in 2017); 

> The number of individuals arrested in relation to right- 
wing terrorist offences continued to increase for the third 
consecutive year (12 in 2016, 20 in 2017,44 in 2018). 
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annex 4 

Convictions and penalties 


This annex contains statistical 
information on the concluded court 
proceedings for terrorist offences 
in 2018 as reported to Eurojust. It 
highlights some key figures and, where 
relevant, compares those with the 
figures for previous years. 


table / Number of individuals in 
concluded court proceedings for 
terrorist offences per EU Member State 
in 2016, 2017 38 and 2018 39 , as reported 
to Eurojust 


38 The data for the previous years corresponds to the 
data reported in the respective TE-SAT reports. 

39 Eurojust received contributions containing 
information on terrorism-related court decisions in 
2018 from the following EU Member States: Austria, 
Belgium, Bulgaria, Czechia, Denmark, Finland, France, 
Germany, Greece, Hungary, Italy, Lithuania, the 
Netherlands, Slovenia, Spain, Sweden and the UK. 

If a verdict pronounced in 2018 was appealed and 
the appeal was concluded before the end of the year, 
Eurojust reported only on the latest/final verdict. 


Member State 

2016 

2017 

2018 

Austria 

26 

18 

36 

Belgium 

136 

85 

80 

Bulgaria 



1 

Czechia 


8 

7 

Denmark 

8 

4 

6 

Estonia 

2 

2 


Finland 

4 

2 

1 

France 

66 

120 

141 

Germany 

30 

34 

57 

Greece 

3 

19 

22 

Hungary 

2 


3 

Italy 

11 

23 

15 

Lithuania 

1 

2 

10 

The Netherlands 

42 

46 

37 

Poland 


4 


Portugal 

1 

1 


Slovenia 

1 


1 

Spain 

154 

69 

120 

Sweden 

4 

3 

1 

United Kingdom 

89 

125 

115 

Total 

580 

565 

653 


> In 2018,17 EU Member States reported a total of 653 
individuals who were convicted or acquitted of terrorist 
offences. Nine of those individuals appeared twice 
before the court in Greece in 2018 in the framework 
of different criminal proceedings and one appeared 
three times. As a result, the total number of verdicts 
pronounced for terrorism-related offences in 2018 was 
664. 


> In 2018 there were 94 female defendants in the 
concluded court proceedings for terrorist offences, 
which is an increase compared to 2017 (66 female 
defendants). 

> France reported the highest number of individuals in 
concluded court proceedings for terrorist offences (141), 
followed by Spain (120), the UK (115) and Belgium (80) 40 . 


40 The UK contribution includes proceedings on offences under anti-terrorism 
legislation, as well as other offences assessed to be terrorism related. Similar to 
previous years, the UK data for 2018 refers only to convictions. 
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table / Number of verdicts in 2018 per EU Member State and 
pertype of terrorism, as reported to Eurojust. 


Member State 

Jihadist 

terrorism 

Ethno-nationalist 
and separatist 
terrorism 

Left-wing 

terrorism 

Right-wing 

terrorism 

Not specified 

Total 

Austria 

35 

1 




36 

Belgium 

76 

4 




80 

Bulgaria 

1 





1 

Czechia 

1 


5 


1 

7 

Denmark 

5 




1 

6 

Finland 

1 





1 

France 

123 

18 





Germany 

38 

2 


17 



Greece 



33 




Hungary 

2 




1 

H 

Italy 

15 





15 

Lithuania 





10 

10 

The Netherlands 

32 



5 


37 

Slovenia 

1 





1 

Spain 

68 

40 

8 


4 

120 

Sweden 

1 





1 

United Kingdom* 

- 


- 


115 

115 

Total 

399 

65 

46 

22 

132 

664 


* The data provided by the UK was not broken down by type of terrorism and is therefore marked as 'Not specified' and not included in the numbers below. 


> In 2018 the vast majority (399) of verdicts in the EU 
Member States were pronounced in relation to jihadist 
terrorist offences confirming a trend that started in 
2015. 

> Courts in France, Belgium and Spain rendered the 
highest number of verdicts concerning jihadist terrorism 
in 2018 (123,76 and 68 respectively). Bulgaria, Finland, 
Italy, Slovenia and Sweden reported only verdicts for 
jihadist terrorism in 2018. 

> Convictions for right-wing terrorist offences (22) 
increased in 2018 compared to 2017 (4). In 2018 such 
convictions were handed down in Germany (17) and the 
Netherlands (5). 

> A higher number of verdicts were also issued for left- 
wing terrorist offences (46 in 2018 as compared to 36 
in 2017). The majority of them were reported by Greece 
(33); courts in Spain and Czechia also heard left-wing 


terrorism cases resulting in eight and five verdicts, 
respectively. 

> The number of verdicts for separatist terrorist offences 
increased compared to 2017 (65 in 2018 compared to 49 
in 2017). As in previous years, the majority of separatist 
terrorism cases were adjudicated in Spain. 

> The majority (64) of the female defendants were tried 
for jihadist terrorist offences, which also presents an 
increase compared to 2017 (42). 

> Similar to 2017, the highest average prison sentence was 
ordered for left-wing terrorist offences and increased 
from ten to sixteen years. The average prison term for 
separatist and right-wing terrorist offences increased 
from four to eight and six years respectively. As in the 
past two years, the average prison sentence for jihadist 
terrorist offences remained five years. 
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table / Number of verdicts, convictions and acquittals per EU 
Member State in 2018, as reported to Eurojust. 


Member State 

Convictions 

Acquittals 

Total 

Acquittals In % 

Austria 

27 

9 

36 

25% 

Belgium 

68 

12 

80 

15% 

Bulgaria 

1 


1 

0% 

Czechia 

1 

6 

7 

86% 

Denmark 

6 


6 

0% 

Finland 

1 


1 

0% 

France 

136 

5 

141 

4% 

Germany 

55 

2 

57 

4% 

Greece 

31 

2 

33 

6% 

Italy 

15 


15 

0% 

Lithuania 

10 


10 

0% 

The Netherlands 

32 

5 

37 

14% 

Slovenia 

1 


1 

0% 

Spain 

85 

35 

120 

29% 

Sweden 

1 


1 

0% 

United Kingdom* 

115 


115 



* The UK data for 2018 refers only to convictions and is not included in the calculations of percentages. 


> No acquittals for terrorist offences were pronounced 
in the concluded court proceedings in eight of the 
EU Member States that reported verdicts for terrorist 
offences in 2018. Successful prosecutions resulting 
only in convictions were concluded in Bulgaria, 
Denmark, Finland, Hungary, Italy, Lithuania, Slovenia 
and Sweden; also France, Germany and Greece had very 
low percentage of acquittals securing convictions for 
the vast majority of those tried for terrorist offences in 
2018 41 . 


41 Eurojust considers it one verdict if an individual is convicted of more than one 
terrorist offence within the same proceeding, or convicted of a terrorist offence 
and acquitted of another offence. If an individual is acquitted of a terrorist 


> Similar to 2017, all prosecutions for right-wing terrorist 
offences in 2018 resulted in convictions. The percentage 
of convictions among the verdicts for jihadist terrorism 
in 2018 remained very high (89 %, same as in 2017). 

The conviction rate for separatist terrorist offences 
remained the same as in 2017 (71 %, while that for left- 
wing offences decreased slightly (from 72 % in 2017 to 
70 % in 2018) 42 . 


offence and convicted of another offence, the verdict is included in the overview 
as acquittal of terrorism. 

42 The data provided by the UK was not broken down by type of terrorism and is 
therefore not used to calculate the conviction rate. 
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annex 5 

Europol counterterrorism activities 


First-line 
investigative 
support: the 
European Counter 
Terrorism Centre 

Recent developments that include 
the completed terrorist attacks 
and a substantial number of failed 
and foiled attacks, combined with 
the existence of large numbers of 
potentially violent jihadist extremists 
in the EU, indicate that the terrorist 
threat towards the EU is high. Despite 
the setback of IS in Iraq and Syria the 
severity of the threat in the EU may 
even increase, in relation to returning 
foreign terrorist fighters and their 
children and wives who may all pose a 
dangerto the security of EU Member 
States, but also as this setback could 
mean that IS will focus even more on 
the West. Addressing the challenges 
and making full use of the available 
Counter Terrorism opportunities 
is key to countering terrorism 
effectively. 

To ensure an effective response to the 
constantly changing developments 
in terrorism, the European Counter 
Terrorism Centre (ECTC) was 
established at Europol, under 


the authority and direction of the 
European Council. It builds further on 
the already existing tools and counter 
terrorism networks of Europol, but 
includes a number of new features. 
These aim at enhancing the counter 
terrorism capabilities and at better 
facilitating information exchange 
among counterterrorism authorities, 
to bring cross-border cooperation in 
this field to a new level. 

The ECTC is designed as a central 
hub in the EU in the fight against 
terrorism. In fact, it is the single point 
in the EU where counter terrorism 
operational information from law 
enforcement from all EU Member 
States, but also from third parties, 
is brought together for analytical 
purposes. Specialised teams of 
counterterrorism analysts and 
experts work on this information to 
construct the wider EU perspective 
on counterterrorism phenomena 
for both operational and strategic 
goals. To ensure efficient information 
exchange, the ECTC benefits from 
an excellent network of counter 
terrorism officers throughout the EU 
and beyond. 

The principal task of the ECTC is to 
provide operational support upon EU 
Member States' request for ongoing 
investigations. The ECTC can assist 


by cross-checking live operational 
data with the already available data 
at Europol, quickly bringing financial 
leads to light and by analysing all 
available investigative details to 
assist in compiling a structured 
picture of the terrorist network. 

If a major terrorist event were to 
occur, the ECTC can contribute to 
a coordinated response. Different 
teams are available for this purpose, 
often combined with counter 
terrorism experts temporarily 
seconded from EU Member States, 
depending on the nature of the event. 

To provide direct operational 
support and to also contribute to 
a coordinated response if major 
terrorist attacks or threats were to 
occur, the ECTC applies a scalable 
approach where otherteams can be 
activated depending on the need. The 
Europol Emergency Response Team 
(EMRT) is an example of this. This 
team comprises Europol experts and 
analysts with relevant backgrounds 
and experience to support emerging 
investigations on a 24/7 basis. 
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Europol Information 
System 

One of Europol's core databases 
is the Europol Information System 
(EIS). Through this system, EU 
Member States directly share and 
retrieve information, including on 
suspects, means of communication, 
financial accounts and firearms, etc. 
connected with serious and organised 
crime and terrorism. 

The EIS offers first-line investigative 
support, as this reference system 
allows EU Member States to quickly 
identify whether or not information 
relevant to them is available in one of 
the EU Member States or with non-EU 
countries or organisations. 

In case of a positive hit, more 
information may then be requested 
through the contributor's Europol 
National Unit. 

At the end of 2018, the EIS held 
information on 63 353 individuals 
linked to terrorism (the vast majority 
linked to the foreign terrorist fighter 
(FTFs) phenomenon), provided by 34 
different contributors. 

Further in-depth 
analysis: Counter 
Terrorism Analysis 
Work File and 
Analytical Projects 

For a more in-depth analysis, 
the ECTC works with the counter 
terrorism analysis work file (AWF). 
This file provides the framework 


for operational analytical support 
with the EU Member States and 
non-EU partners. As a result, the 
number of data categories that are 
permitted to be stored and processed 
is broader than in the EIS (within 
the counter terrorism AWF, there is 
focused analysis on certain counter 
terrorism phenomena). Existing 
and emerging terrorist phenomena 
are handled within separate files, 
known as Analysis Projects (APs). 

In these highly secure environments 
the information is collected, cross- 
matched and analysed. This is done 
by dedicated teams of counter 
terrorism analysts and counter 
terrorism experts. Within counter 
terrorism, a major AP is the topic of 
'travellers', which deals with foreign 
terrorist fighters. The amount of data 
on foreign terrorist fighters within the 
AP Travellers increased substantially 
in 2018 as a result of the concerted 
efforts of EU Member States with the 
assistance of Europol. 

In December 2017, the ECTC opened 
a new AP on Core International 
Crimes which is related to war 
crimes, crimes against humanity and 
genocide 43 . 

The ECTC uses an integrated 
approach meaning that data inserted 
in one system is automatically cross¬ 
checked against all other databases 
at Europol to close intelligence gaps. 
In addition, regular manual checks are 
carried out. 


43 The AP on Core International Crimes works 
together closely with the Genocide Network, 
also known as the European Union Network for 
Investigation and Prosecution of Genocide, Crimes 
Against Humanity and War Crimes, hosted by 
Eurojust. 


Information 
exchange: SIENA 

In an organisation like Europol, 
with its main focus on information 
exchange, the secure and swift 
transmission of data is essential, 
especially when it comes to counter 
terrorism data. Information from a 
Member State must reach Europol 
and vice versa, without the risk 
of interception. To facilitate this 
information exchange, the Secure 
Information Exchange Network 
Application (SIENA) was designed 
and has been in use for a number of 
years by EU Member States, Europol 
and third parties that have operational 
cooperation agreements with 
Europol. 

A dedicated area has been created 
within SIENA especially for counter 
terrorism authorities. This means 
that counter terrorism authorities 
now have the possibility to send 
information directly to Europol or 
other counter terrorism authorities. 
Until recently, countries could only 
use SIENA to send their contributions 
on terrorism to Europol indirectly, 
through the Europol National Unit 
and Liaison Bureau. The extended 
infrastructure now also allows 
counter terrorism authorities from 
different countries to directly 
exchange information among 
themselves, with optional involvement 
of Europol. Involvement of Europol is 
recommended to avoid that possible 
links to other EU Member States and 
third partners remain undiscovered, 
as well as to identify potential 
links between organised crime and 
terrorism. 
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In practice, this means that every 
counter terrorism officer in the 
EU Member States can check the 
EIS from their own computers and 
directly send information to, or 
receive information from, the Analysis 
Projects. The options described 
for sharing information are at the 
discretion of the Member State. 

European Union 
Internet Referral 
Unit 

The EU Internet Referral Unit (EU 
IRU) coordinates EU efforts to tackle 
access to online terrorist propaganda 
and delivering operational support 
to high profile CT cases. The unit 
is developing an agile operational 
support model, in order to further 
enhance ECTC rapid response to 
terrorist attacks and expand the EU 
law enforcement toolbox, especially 
in niche technical capabilities. The EU 
IRU keeps abreast with the innovation 
employed by terrorist groups to 
exploit the online environment, 
forthe purpose of disseminating 
terrorist propaganda, recruitment 
to terrorist organisations and the 
planning and execution of terrorist 
attacks. By the end of 2018, the EU 
IRU supported 222 operations and 
delivered 339 operational products. It 
also assessed in total 87 819 pieces 
of content, which triggered 85 477 
decisions for referral, with a success 
rate of removal of 84.85 % since it 
was setup in July 2015. 


Terrorism 
Finance Tracking 
Programme 

The ECTC uses a number of tools to 
help detect the financing of terrorism, 
one of the best known is the Terrorist 
Finance Tracking Programme (TFTP). 
The TFTP was established following 
an EU-US agreement adopted by the 
European Parliament in 2010. 

Relevant information obtained 
through the TFTP is provided by 
the US Department of the Treasury 
to Europol, competent authorities 
of EU Member States and Eurojust 
either spontaneously by the US, or 
upon request, pursuant to Article 
9 or Article 10 of the Agreement 
respectively, with the aim of 
combating terrorism and terrorist 
financing. 

TFTP has proven to be a valuable tool 
in terrorism-related investigations, 
it enhances the ability to map out 
terrorist networks, often by filling 
in missing links in an investigative 
chain. It is used to track terrorist 
money flows, allowing authorities to 
identify and locate operatives and 
their financiers and assists in broader 
efforts to uncover terrorist cells. 

Chemical, 
biological, 
radiological 
and nuclear and 
explosives 

Europol is a key partner in the 
Chemical, Biological, Radiological and 
Nuclear (CBRN) and Explosives field, 
working together with the national 


competent authorities (from EU 
Member States and non-EU countries) 
and liaising, assisting and jointly 
promoting activities and training with 
the European Commission and other 
relevant international organisations in 
these areas of expertise. 

The European Explosive Ordnance 
Disposal (EOD) Units Network, with 
its EOD and CBRN expert working 
groups continues to be facilitated 
and actively supported by Europol. 
This network is one of the main 
achievements stemming from the EU 
Action Plan on Enhancing the Security 
of Explosives. 

A new platform forthe European 
Explosives Ordnance Units Network 
on the Europol Platform of Experts 
(EPE) has become the main 
communication channel enabling 
already more than 300 European 
bomb technicians and CBRN experts 
to swiftly, efficiently and directly 
share knowledge, best practices and 
technical information on recent cases 
and incidents. 

The bomb-making process, potential 
recipes forthe harmful use of 
explosives precursors, as well as 
potential new threats using CBRN 
materials, are monitored daily and 
cross-checked by Europol's ECTC 
experts. Information is shared with 
experts and relevant units within 
the EU Member States and non-EU 
countries. 

Europol assessments, strategic 
reports and expertise are also timely 
in detecting security gaps and feeding 
the EU Policy Cycle through effective 
cooperation with the European 
Commission. 

In October 2017, the European 
Commission issued a new Action Plan 
to enhance preparedness against 
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CBRN security risks, enhancing 
Europol's role as a key player in CBRN 
security. 

The ECTC - Strategy CBRN and 
Explosives Team also assists EU 
Member States operationally, both 
with counterterrorism and serious 
and organised crime investigations. 
This includes having Europol staff 
appointed as court experts. 

The Counter 
Terrorism Joint 
Liaison Team 

The Counter Terrorism Joint Liaison 
Team (CT JLT) was established by 
the EU Member States to improve the 
speed and quality of CT cooperation. 
It functions as a platform for the swift 
exchange of operational information 
and actionable intelligence among 
dedicated counterterrorism experts 
and analysts from the EU Member 
States, associated non-EU countries 
and Europol. The CT JLT facilitates 


generating added value to all shared 
CT cases, acting as a force multiplier 
to individual counter-terrorism efforts 
by EU Member States and Third 
Parties. 

Team of rotating 
Guest Officers 
at immigration 
hotspots 

Europol provided support to Italy 
and Greece by deploying short-term 
Seconded National Experts (Guest 
Officers) at hotspots on the eastern 
Aegean islands and in southern Italy. 
Up to 50 of these Guest Officers 
are deployed on rotation in order to 
strengthen the security checks on 
the inward migration flow, in order 
to identify suspected terrorists and 
criminals, thus providing additional 
security checks. 

There is no concrete evidence that 
terrorist travellers systematically 


use those flows of refugees to enter 
Europe unnoticed, but it is indisputable 
that some terrorists have entered the 
EU posing as a refugee 44 , as was seen 
in the Paris attacks of 13 November 
2015. 

To counter this threat, Europol has 
recently approved the recruitment 
of up to 200 counter terrorist and 
other investigators for deployment to 
migration hotspots in Greece and Italy. 

European 

Cybercrime Centre 

Launched in January 2013 the 
European Cybercrime Centre (EC3) 
delivers high-level technical, analytical 
and digital forensic expertise to 
support investigations by EU Member 
States and non-EU countries in cases 
of convergence of cyber and terrorism. 


44 Europol, Changes in modus operandi of Islamic 
State (IS) revisited, 2016. 
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annex 6 

Methodology 


The TE-SAT was established in the 
aftermath of the 11 September 2001 
attacks in the USA, as a reporting 
mechanism from the Terrorism 
Working Party (TWP) of the Council of 
the EU to the European Parliament. In 
2006 Europol replaced the TWP. The 
methodology for producing this annual 
report was developed by Europol and 
endorsed by the Justice and Home 
Affairs (JHA) Council on 1 and 2 June 
2006. 

The content of the TE-SAT is based on 
information supplied by EU Member 
States, some non-EU countries and 
the partner organisation Eurojust, as 
well as information gained from open 
sources. 

In accordance with ENFOPOL 65 
(8196/2/06), the TE-SAT is produced 
annually to provide an overview of 
the terrorism phenomenon in the EU, 
from a law enforcement perspective, 
it seeks to record basic facts and 
assemble figures regarding terrorist 
attacks and arrests in the EU. The 
report also aims to present trends and 
new developments identified from the 
information available to Europol. 

The TE-SAT is a situation report which 
describes and analyses the outward 
manifestations of terrorism, i.e. 
terrorist attacks and activities, it does 
not seek to analyse the root causes 
of terrorism, neither does it attempt 
to assess the impact or effectiveness 
of counter-terrorism policies and 
law enforcement measures taken, 
although it can serve to illustrate some 
of these. 

This edition of the TE-SAT has been 
produced by Europol in consultation 
with the TE-SAT Advisory Board, 
composed of representatives of the 
past, present and future Presidencies 
of the Council of the EU, i.e. Austria, 
Romania and Finland (the 'troika'), 
along with permanent members, 


representatives from France and 
Spain, EU Intelligence Analysis Centre 
(INTCEN), Eurojust, the office of the 
EU Counter Terrorism Coordinator (EU 
CTC), and Europol staff. 

For the preparation of this report, 
Europol collected qualitative and 
quantitative data on terrorist offences 
in the EU and data on arrests of people 
suspected of involvement in those 
offences, provided or confirmed by 
EU Member States. Similar data were 
collected, when available, of offences 
in which EU interests were affected 
outside of the EU. As in previous years, 
Eurojust collected data on the number 
of court proceedings in each Member 
State, the number of individuals in 
concluded court proceedings, the 
number of convictions and acquittals, 
the type of terrorism, the gender of 
defendants, the penalties imposed, 
as well as the type of verdicts - final 
or pending judicial remedy. Eurojust 
contributed data on convictions 
and penalties for terrorist offences 
in EU Member States and relevant 
amendments in national legislation on 
terrorism. 

Included as arrests are those judicial 
arrests warranted by a prosecutor 
or investigating judge, whereby a 
person is detained for questioning on 
suspicion of committing a criminal 
offence for which detention is 
permitted by national law. The fact 
that the person may subsequently be 
provisionally released or placed under 
house arrest does not impact the 
calculation of the number of arrests. 

The definition of the term terrorist 
offences is indicated in the Directive 
(EU) 2017/541 Directive (EU) 2017/541 
of the European Parliament and of 
the Council of 15 March 2017 on 
combating terrorism and replacing 
Council Framework Decision 
2002/475/JHA and amending Council 


Decision 2005/671/JHA, which all EU 
Member States have implemented in 
their national legislation. This Directive 
specifies that terrorist offences are 
intentional acts which, given their 
nature or context, may seriously 
damage a country or an international 
organisation when committed with 
the aim of: seriously intimidating 
a population, or unduly compelling 
a government or international 
organisation to perform or abstain 
from performing an act, or seriously 
destabilising or destroying the 
fundamental political, constitutional, 
economic or social structures 
of a country or an international 
organisation. 

In cases in which the wording of 
Directive 2017/541 leaves room 
for interpretation, the TE-SAT 
2019 respects EU Member States' 
definitions of terrorist offences on 
their territories. At times, it can be 
difficult to assess whether a criminal 
event should be regarded as an act of 
terrorism or as an act of extremism. 
Contrary to terrorism, not all forms 
of extremism sanction the use of 
violence. Nevertheless, extremism 
as a phenomenon may be related 
to terrorism and exhibit similar 
behavioural patterns. Therefore, 
the TE-SAT 2019 mentions criminal 
acts with the potential to seriously 
destabilise or destroy the fundamental 
political, constitutional, economic 
or social structures of a country, 
when they were reported by the EU 
Member States as extremism, in an 
effort to provide a clearer picture of 
the phenomenon and its relation to 
terrorism. However, these cases were 
not considered in the statistical data 
of this report, which exclusively reflect 
incidents reported as terrorism by EU 
Member States. 

The EU Council Decision of 20 
September 2005 (2005/671/ JHA), 
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on the exchange of information and 
cooperation concerning terrorist 
offences, obliges EU Member States 
to collect all relevant information 
concerning and resulting from criminal 
investigations conducted by their 
law enforcement authorities with 
respect to terrorist offences and sets 
out the conditions under which this 
information should be sent to Europol. 
Europol processed the data and the 
results were cross-checked with 
the EU Member States. In cases of 
divergences or gaps, the results were 
corrected, complemented and then 
validated by the EU Member States. 

Eurojust also collected data on 
prosecutions and convictions for 
terrorist offences on the basis of 
the aforementioned EU Council 
Decision. The data used in this report 
concerns relevant court decisions 
and legislation amendments in 2018. 
Due to the specifics of reporting, 
Member States submit information 
on both final and non-final decisions. 
Therefore, reference is also made 
to those decisions pending judicial 
remedy. Verdicts from 2018 on which 
an appeal is pending are included 
in the reporting as pending judicial 
remedy. In cases where a verdict 
pronounced in 2018 was appealed 
and the appeal was concluded before 
the end of the year, Eurojust counted 
the proceeding as one. Eurojust's 
contribution was verified with the EU 
Member States that provided relevant 
data. 

Types of terrorism 

TheTE-SAT categorises terrorist 
organisations by their source of 
motivation. However, many groups 
have a mixture of motivating 
ideologies, although usually one 
ideology or motivation dominates. It 
is worth noting that a categorisation 
of individuals and terrorist groups 


based on the ideology or goals they 
espouse should not be confused with 
motivating factors and the paths to 
radicalisation. The underlying causes 
that lead people to radicalisation 
and terrorism must be sought in the 
surroundings (structural factors) 
and personal interpretations 
(psychological factors) of the 
individual. The choice of categories 
used in the TE-SAT reflects the current 
situation in the EU as reported by EU 
Member States. The categories are 
not necessarily mutually exclusive. 

Jihadist 

Jihadist terrorist acts are those that 
are committed out of a mind-set 
that rejects democracy on religious 
grounds and uses the historical 
comparison with the crusades of 
the Middle Ages to describe current 
situations, in which it is believed 
that Sunni Islam is facing a crusader 
alliance composed of Shi'is, Christians 
and Jews. 

Right-wing 

Right-wing terrorist organisations 
seek to change the entire political, 
social and economic system on an 
extremist right-wing model. A core 
concept in right-wing extremism is 
supremacism or the idea that a certain 
group of people sharing a common 
element (nation, race, culture, etc.) is 
superior to all other people. Seeing 
themselves in a supreme position, 
the particular group considers it is 
their natural right to rule over the rest 
of the population. Racist behaviour, 
authoritarianism, xenophobia and 
hostility to immigration are commonly 
found attitudes in right-wing 
extremists. Right-wing terrorism refers 
to the use of terrorist violence by 
right-wing groups. Variants of right- 
wing extremist groups are the neo- 
Nazi, neo-fascist and ultra-nationalist 
formations. 


Left-wing and anarchist terrorism 

Left-wing terrorist groups seek to 
replace the entire political, social 
and economic system of a state by 
introducing a communist or socialist 
structure and a classless society. Their 
ideology is often Marxist-Leninist. A 
sub-category of left-wing extremism is 
anarchist terrorism which promotes a 
revolutionary, anti-capitalist and anti¬ 
authoritarian agenda. Examples of left- 
wing terrorist groups are the Italian 
Brigate Rosse (Red Brigades) and the 
Greek Revolutionary Organisation 17 
November. 

Ethno-nationalism and separatism 

Ethno-nationalist and separatist 
terrorist groups are motivated by 
nationalism, ethnicity and/or religion. 
Separatist groups seek to carve out 
a state for themselves from a larger 
country or annex territory from one 
country to that of another. Left- or 
right-wing ideological elements are not 
uncommon in these types of groups. 
The Irish Republican Army (IRA), the 
Basque ETA and the Kurdish PKK 
organisations fall into this category. 

Single-issue 

Single-issue extremist groups aim to 
change a specific policy or practice, 
as opposed to replacing the whole 
political, social and economic system 
in a society. The groups within this 
category are usually concerned 
with animal rights, environmental 
protection, anti-abortion campaigns, 
etc. Examples of groups in this 
category are the Earth Liberation Front 
(ELF) and the Animal Liberation Front 
(ALF). 
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annex 7 

Acronyms 


AF 

al-Abd al-Faqir 

ALF 

Animal Liberation Front 

AMISOM 

African Union Mission in Somalia 

ANP 

Arm na Poblachta, Army of the Republic 

AP 

Analysis Project 

AQIM 

al-Qaeda in the Islamic Maghreb 

AWF 

Analysis work fde 

CBRN 

chemical, biological, radiological and 
nuclear 

CIRA 

Continuity Irish Republican Army 

CT JLT 

Counter Terrorism Joint Liaison Team 

DDoS 

Distributed Denial of Service 

DHKP-C 

Devrimci Halk Kurtulu? Partisi-Cephesi 
Revolutionary People's Liberation Party/ 

Front 

DR 

Dissident Republican 

EC3 

European Cybercrime Centre 

ECTC 

European Counter Terrorism Centre 

EFP 

explosively formed projectile 

EIS 

Europol Information System 

ELF 

Earth Liberation Front 

EOD 

Explosive Ordnance Disposal 

EPE 

Europol Platform of Experts 

ETA 

Euskadi ta Askatasuna 

Basque Fatherland and Liberty 

EU 

European Union 

EU INTCEN 

EU Intelligence Analysis Centre 

FAI/FRI 

Federazione Anarchica Informale/Fronte 
Rivoluzionario Internazionale 

FARC 

Fuerzas Armadas Revolucionarias de 
Colombian 

Colombian Revolutionary Armed Forces 

FTF 

foreign terrorist fighter 

GNA 

Informal Anarchist Federation/International 
Revolutionary Front 

HME 

Jama'at Nusrat al-lslam wal-Muslimin 

Group in support of Islam and Muslims 

HPG 

Kosovo Force 

HSM 

The United Nations Multidimensional 
Integrated Stabilization Mission in Mali 

HTS 

Nordiska Motstandsrorelsen 

Nordic Resistance Movement 

ICRC 

International Committee of the Red Cross 

IED 

improvised explosive device 

1 ID 

improvised incendiary device 

IS 

so-called Islamic State 

ISGA 

Islamic State in the Greater Sahara 


JHA 

Justice and Flome Affairs 

JNIM 

Jama'at Nusrat al-lslam wal-Muslimin 

Group in support of Islam and Muslims 

LNA 

Libyan National Army 

MINUSMA 

The United Nations Multidimensional 
Integrated Stabilization Mission in Mali 

MOJWA 

Movement for Oneness and Jihad in West 
Africa 

NIRA 

New Irish Republican Army 

NMR 

Nordiska Motstandsrorelsen 

Nordic Resistance Movement 

ONH 

Oglaigh na h'Eireann 

Warriors of Ireland 

Pegida 

Patriotische Europaer gegen die 

Islamisierung des Abendlandes 

Patriotic Europeans against the Islamisation 
of the Occident 

PKK 

Partiya Karkeren Kurdistan 

Kurdistan Workers' Party 

RWE 

Right-wing extremists 

SAMLA 

Sanctions and Anti-Money Laundering 

Act 

SIENA 

Secure Information Exchange Network 
Application 

TATP 

triacetone triperoxide 

TE-SAT 

European Union Terrorism Situation and 
Trend Report 

TFTP 

Terrorist Finance Tracking Programme 

THD 

Tanzim Hurras al-Din 

Guardians of the religion organisation 

TWP 

Terrorism Working Party 

UAV 

unmanned aerial vehicle 

UCC 

United Cyber Caliphate 

UN 

United Nations 

SGC 

supporter-generated content 

VBIED 

vehicle-borne improvised explosive 
device 

VOIED 

victim-operated improvised explosive 
device 

YPG 

Yekineyen Parastina Gel 

People's Protection Units 
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